Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ref: micro-optimise by reserving buffer size #803

Merged
merged 3 commits into from
Mar 1, 2023
Merged

ref: micro-optimise by reserving buffer size #803

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3da4274
ref: micro-optimise by reserving buffer size
flub Feb 28, 2023
5a25b51
Merge branch 'main' into flub/reserve-buf
flub Mar 1, 2023
7818731
Add protection against receiving too large messages
flub Mar 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/protocol.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ use std::io;
use std::str::FromStr;

use abao::decode::AsyncSliceDecoder;
use anyhow::{ensure, Context, Result};
use anyhow::{bail, ensure, Context, Result};
use bytes::{Bytes, BytesMut};
use postcard::experimental::max_size::MaxSize;
use quinn::VarInt;
Expand Down Expand Up @@ -92,6 +92,10 @@ pub(crate) async fn read_lp(
};
let mut reader = reader.take(size);
let size = usize::try_from(size).context("frame larger than usize")?;
if size > MAX_MESSAGE_SIZE {
bail!("Incoming message exceeds MAX_MESSAGE_SIZE");
}
buffer.reserve(size);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be limited, I can now easily attack your machine by putting a crazy value here, and causing an OOM

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My thinking was that I wasn't at all changing how much is being allocated, this attack already existed. To be fair I also faultily assumed MAX_MESSAGE_SIZE was already being respected while it obviously wasn't.

So fair shout, MAX_MESSAGE_SIZE wasn't being checked yet so may as well improve this.

loop {
let r = reader.read_buf(buffer).await?;
if r == 0 {
Expand Down