[
https://issues.apache.org/jira/browse/PROTON-2954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106695#comment-18106695
]
ASF subversion and git services commented on PROTON-2954:
---------------------------------------------------------
Commit ad3e3f489b086c40de3952dabd59fd8546d54e01 in qpid-proton's branch
refs/heads/main from Andrew Stitcher
[ https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=ad3e3f489 ]
PROTON-2954: Improve testing for pn_data_t
> Decoding AMQP value into pn_data_t instances can use a lot of memory
> --------------------------------------------------------------------
>
> Key: PROTON-2954
> URL: https://issues.apache.org/jira/browse/PROTON-2954
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-c
> Affects Versions: proton-c-0.40.0
> Reporter: Andrew Stitcher
> Assignee: Andrew Stitcher
> Priority: Major
> Fix For: proton-c-0.41.0
>
>
> Proton has limited ways to bound the amount of memory used when decoding peer
> controlled AMQP values into a pn_data_t structure.
> There are 2 parts to the structure that use space: A list of nodes which
> represent the structure of the data and a backing buffer for some of the
> types of value which are variable length or long like strings or binary data.
> There *is* a limit to the number of nodes which is 65535 in the current code,
> but that still equates to a lot of memory used for he nodes; but there
> currently is no limit to the memory used for the backing data.
> This could cause problems with malformed or malicious input data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
