In decode.rs, impl Read for Decoder is defined recursively. While all recursive calls are in the tail position, Rust does not guarantee eliminating tail calls, so this can overflow the stack given a malicious input.
Attachments:
- test.patch contains a test that fails on master.
- loop.patch refactors
Read for Decoder to use a loop. With this patch, test.patch succeeds.
test.patch
loop.patch
In decode.rs,
impl Read for Decoderis defined recursively. While all recursive calls are in the tail position, Rust does not guarantee eliminating tail calls, so this can overflow the stack given a malicious input.Attachments:
Read for Decoderto use a loop. With this patch, test.patch succeeds.test.patch
loop.patch