Skip to content

Check that total compound dictionary size does not overflow.#1450

Merged
copybara-service[bot] merged 1 commit intomasterfrom
test_896514011
Apr 8, 2026
Merged

Check that total compound dictionary size does not overflow.#1450
copybara-service[bot] merged 1 commit intomasterfrom
test_896514011

Conversation

@copybara-service
Copy link
Copy Markdown

@copybara-service copybara-service Bot commented Apr 8, 2026

Check that total compound dictionary size does not overflow.

Thanks to @mohammadmseet-hue who reported the problem in #1438 on 29.03.2026
Thanks to @0xazanul who reported the problem in #1443 on 31.03.2026

NB: it is unlikely a security threat; since all the dictionaries are loaded to memory before use, practically that means that their memory ranges do not intersect; moreover brotli codec does not support entities that are 64MiB+ away; consequently total amount of attached dictionaries could never reach 64MiB+ (15 times 64MiB if developer is careless).

@copybara-service copybara-service Bot force-pushed the test_896514011 branch 2 times, most recently from fd758c0 to 49a1a0c Compare April 8, 2026 19:17
Thanks to @0xazanul who reported the problem in #1438

PiperOrigin-RevId: 896638456
@copybara-service copybara-service Bot merged commit 4792c8e into master Apr 8, 2026
@copybara-service copybara-service Bot deleted the test_896514011 branch April 8, 2026 19:24
@0xazanul
Copy link
Copy Markdown
Contributor

0xazanul commented Apr 8, 2026

Hey just for confirmation the issue i reported is in 1443 not 1438 , can u guys confirm

@eustas
Copy link
Copy Markdown
Collaborator

eustas commented Apr 8, 2026

Actually it is reported both in #1438 and #1443, so yup, I can confirm. First PR is a fix, second one adds fuzzer.

@0xazanul
Copy link
Copy Markdown
Contributor

0xazanul commented Apr 8, 2026

so i reported it earlier to google vrp and they said first i need to get it merged, so does this qualify as this has been merged ?

@eustas
Copy link
Copy Markdown
Collaborator

eustas commented Apr 8, 2026

Yes, I believe so. Could mention that in original PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants