Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security1 #216

Merged
merged 9 commits into from Jun 10, 2022
Add depth checks to potentially recursive data
  • Loading branch information
locka99 committed Jun 5, 2022
commit e75dada28a40c3fefc4aeee4cdc272e1b748f8dd
2 changes: 1 addition & 1 deletion lib/src/types/encoding.rs
Expand Up @@ -133,7 +133,7 @@ impl DecodingOptions {
Self::default()
}

fn depth_lock(&self) -> core::result::Result<DepthLock, StatusCode> {
pub fn depth_lock(&self) -> core::result::Result<DepthLock, StatusCode> {
DepthLock::obtain(self.decoding_depth_gauge.clone())
}
}
Expand Down
2 changes: 2 additions & 0 deletions lib/src/types/extension_object.rs
Expand Up @@ -84,6 +84,8 @@ impl BinaryEncoder<ExtensionObject> for ExtensionObject {
}

fn decode<S: Read>(stream: &mut S, decoding_options: &DecodingOptions) -> EncodingResult<Self> {
// Extension object is depth checked to prevent deep recursion
let _depth_lock = decoding_options.depth_lock()?;
let node_id = NodeId::decode(stream, decoding_options)?;
let encoding_type = u8::decode(stream, decoding_options)?;
let body = match encoding_type {
Expand Down
3 changes: 3 additions & 0 deletions lib/src/types/variant.rs
Expand Up @@ -1012,8 +1012,11 @@ impl Variant {
} else if Self::test_encoding_flag(encoding_mask, EncodingMask::LOCALIZED_TEXT) {
Self::from(LocalizedText::decode(stream, decoding_options)?)
} else if Self::test_encoding_flag(encoding_mask, EncodingMask::EXTENSION_OBJECT) {
// Extension object internally does depth checking to prevent deep recursion
Self::from(ExtensionObject::decode(stream, decoding_options)?)
} else if Self::test_encoding_flag(encoding_mask, EncodingMask::VARIANT) {
// Nested variant is depth checked to prevent deep recursion
let _depth_lock = decoding_options.depth_lock()?;
Variant::Variant(Box::new(Variant::decode(stream, decoding_options)?))
} else if Self::test_encoding_flag(encoding_mask, EncodingMask::DATA_VALUE) {
Self::from(DataValue::decode(stream, decoding_options)?)
Expand Down