[
https://issues.apache.org/jira/browse/PROTON-2954?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrew Stitcher resolved PROTON-2954.
-------------------------------------
Resolution: Fixed
> Decoding AMQP value into pn_data_t instances can use a lot of memory
> --------------------------------------------------------------------
>
> Key: PROTON-2954
> URL: https://issues.apache.org/jira/browse/PROTON-2954
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-c
> Affects Versions: proton-c-0.40.0
> Reporter: Andrew Stitcher
> Assignee: Andrew Stitcher
> Priority: Major
> Fix For: proton-c-0.41.0
>
>
> Proton has limited ways to bound the amount of memory used when decoding peer
> controlled AMQP values into a pn_data_t structure.
> There are 2 parts to the structure that use space: A list of nodes which
> represent the structure of the data and a backing buffer for some of the
> types of value which are variable length or long like strings or binary data.
> There *is* a limit to the number of nodes which is 65535 in the current code,
> but that still equates to a lot of memory used for he nodes; but there
> currently is no limit to the memory used for the backing data.
> This could cause problems with malformed or malicious input data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
