tinylib / msgp

A Go code generator for MessagePack / msgpack.org[Go]
MIT License
1.81k stars 192 forks source link

Add recursion limit for dynamic code #358

Closed klauspost closed 2 months ago

klauspost commented 2 months ago

Prevent adversarial stack exhaustion on:

Decoder:

Standalone:

Limit is set to 100K recursive map/slice operations. I know it is insanely high, but we are really just trying to not run out of stack.