Skip to content

fields: decode BitLenField integers with int.from_bytes - #5108

Merged
gpotter2 merged 1 commit into
secdev:masterfrom
KernelClint:perf/bitlenfield-from-bytes
Aug 27, 2026
Merged

fields: decode BitLenField integers with int.from_bytes#5108
gpotter2 merged 1 commit into
secdev:masterfrom
KernelClint:perf/bitlenfield-from-bytes

Conversation

@KernelClint

Copy link
Copy Markdown
Contributor

Mpint.length controls the width of an SSH key-exchange integer at
scapy/layers/ssh.py:102-105.
_BitField.getfield() unpacks the value into individual bytes and performs one growing shift for
each at
scapy/fields.py:2432-2447,
so an SSH peer can make numeric parsing quadratic.

Median decoding grew to 2,403.01 ms at 256,000 bytes, with a 1.89 exponent and a 1.2% noise floor.
Patched decoding took 0.21 ms at 256,000 bytes and 0.83 ms at 1,024,000 bytes, with a 0.98 exponent
and an 8.1% noise floor.

This change retains the existing short-buffer struct.error and converts the complete value with
int.from_bytes(). The focused regression counted eight conversions before the patch and one
after it.

@codecov

codecov Bot commented Aug 26, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.60%. Comparing base (ba8641a) to head (207d480).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5108   +/-   ##
=======================================
  Coverage   80.59%   80.60%           
=======================================
  Files         390      390           
  Lines       96892    96895    +3     
=======================================
+ Hits        78094    78099    +5     
+ Misses      18798    18796    -2     
Files with missing lines Coverage Δ
scapy/fields.py 92.87% <100.00%> (-0.01%) ⬇️

... and 8 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2
gpotter2 merged commit 850f7b2 into secdev:master Aug 27, 2026
23 checks passed
KernelClint added a commit to KernelClint/scapy that referenced this pull request Sep 2, 2026
Move the fix from Kerberos into the BER codec, as reviewed.

BERcodec_INTEGER.do_dec shifted a growing Python integer one octet at a
time, so the cost of each octet rose with the number already accumulated
and decoding was quadratic in the encoded width. A sender could multiply
parsing cost by padding any INTEGER with leading sign octets, in any
protocol that uses BER, not only in a Kerberos etype. Decoding 64,000
content octets took 304 ms; int.from_bytes does the same two's-complement
conversion in one pass, in 0.03 ms, and agrees with the old loop on every
input tested.

This drops the Kerberos-specific Int32 width check the first version of
this pull request added. Nothing is rejected now that was accepted
before: the field is parsed, only more cheaply.

The regression test counts that the conversion happens once rather than
per octet, the way the BitLenField test added in secdev#5108 does.

AI-Assisted: yes (GPT-5.6-Cyber)
gpotter2 pushed a commit that referenced this pull request Sep 2, 2026
* kerberos: reject encryption types wider than Int32

AI-Assisted: yes (GPT-5.6-Cyber)

* asn1: decode BER integers with int.from_bytes

Move the fix from Kerberos into the BER codec, as reviewed.

BERcodec_INTEGER.do_dec shifted a growing Python integer one octet at a
time, so the cost of each octet rose with the number already accumulated
and decoding was quadratic in the encoded width. A sender could multiply
parsing cost by padding any INTEGER with leading sign octets, in any
protocol that uses BER, not only in a Kerberos etype. Decoding 64,000
content octets took 304 ms; int.from_bytes does the same two's-complement
conversion in one pass, in 0.03 ms, and agrees with the old loop on every
input tested.

This drops the Kerberos-specific Int32 width check the first version of
this pull request added. Nothing is rejected now that was accepted
before: the field is parsed, only more cheaply.

The regression test counts that the conversion happens once rather than
per octet, the way the BitLenField test added in #5108 does.

AI-Assisted: yes (GPT-5.6-Cyber)

* asn1: trim the comment on the BER integer decode

AI-Assisted: yes (GPT-5.6-Cyber)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants