[
https://issues.apache.org/jira/browse/PROTON-2968?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115328#comment-18115328
]
ASF subversion and git services commented on PROTON-2968:
---------------------------------------------------------
Commit 040c0993f3b85205607740f2c847ea7ef754693d in qpid-proton's branch
refs/heads/main from Andrew Stitcher
[ https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=040c0993f ]
PROTON-2968: pn_decoder_decode rejects too large compound counts
Elements of a zero width type (null, true, ...) take up no input bytes at all,
so the child count together with the input size in an array of these does not
bound the size of the decoded array.
A compound with more children than the allowed number of nodes in a pn_data_t
couldn't fit in the node array, so reject the count outright with
PN_OUT_OF_MEMORY, which is what a decode that ran out of nodes would report
anyway.
Assisted-By: Claude Opus 5 <[email protected]>
> pn_decoder_decode rejects compound counts too large for the node array
> ----------------------------------------------------------------------
>
> Key: PROTON-2968
> URL: https://issues.apache.org/jira/browse/PROTON-2968
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-c
> Reporter: Andrew Stitcher
> Assignee: Andrew Stitcher
> Priority: Major
> Fix For: proton-c-0.41.0
>
>
> Elements of a zero width type (null, true, ...) take up no input bytes at
> all, so the count in an array header is not bounded by the size the header
> declares, the way a list's would be.
> No array with a count larger than the maximum allowed would be decoded into
> the node array, so reject the count outright as soon as the header is read,
> with PN_OUT_OF_MEMORY - which is what a decode that ran out of nodes would
> report anyway.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
