Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allocate byte[] lazily for longer Smile binary data payloads (raw) #260

Closed
cowtowncoder opened this issue Mar 20, 2021 · 2 comments
Closed
Labels
fuzz Issue found by OssFuzz smile
Milestone

Comments

@cowtowncoder
Copy link
Member

(from https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32180)

Looks like eager allocation is used for Smile binary payload if using "raw"/native embedding.
Similar to #186, this should be only used for relatively short payloads to avoid potential for DoS by attacker specifying allegedly large data size but only sending minimal partial message (essentially just marker, length and maybe a bit or two)

@cowtowncoder
Copy link
Member Author

The issue seems oddly resistant to reproduction: for some reason, allocating a 2-gig byte array succeeds despite my trying to limit heap to 0.5 gigs (for example).

@cowtowncoder cowtowncoder added this to the 2.12.3 milestone Mar 20, 2021
@cowtowncoder
Copy link
Member Author

Needed to add Surefire (junit) plugin configuration to limit heap for forked-off test process, now test fails as expected from command-line.

@cowtowncoder cowtowncoder changed the title Allocate byte[] lazily for longer Smile binary data payloads Allocate byte[] lazily for longer Smile binary data payloads (raw) Mar 24, 2021
@cowtowncoder cowtowncoder added the fuzz Issue found by OssFuzz label Apr 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fuzz Issue found by OssFuzz smile
Projects
None yet
Development

No branches or pull requests

1 participant