jonhoo / jonhoo/async-bincode

No way to limit memory usage

Open
#18 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
76
Forks
9
PR merge metrics
No merged PRs in 30d

Description

`bincode` allows limiting the memory usage of deserialized objects, and `async-bincode` should probably provide a facility for this as well. Without it, attackers are able to consume up to 8GB of RAM (2* 2^32 bytes, once for the buffer, the other for the deserialized message).

In addition, on 32bit platforms, the calculation of the needed buffer size is prone to an overflow. As far as I can see, this is not actually problematic as it just causes the deserialization to fail. The memory exhaustion attack due to being unable to limit memory consumed for buffers is probably the worse vector on these platforms.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.