Andrew Stitcher created PROTON-2954:
---------------------------------------
Summary: Decoding AMQP value into pn_data_t instances can use a
lot of memory
Key: PROTON-2954
URL: https://issues.apache.org/jira/browse/PROTON-2954
Project: Qpid Proton
Issue Type: Bug
Components: proton-c
Affects Versions: proton-c-0.40.0
Reporter: Andrew Stitcher
Assignee: Andrew Stitcher
Fix For: proton-c-0.41.0
Proton has limited ways to bound the amount of memory used when decoding peer
controlled AMQP values into a pn_data_t structure.
There are 2 parts to the structure that use space: A list of nodes which
represent the structure of the data and a backing buffer for some of the types
of value which are variable length or long like strings or binary data.
There *is* a limit to the number of nodes which is 65535 in the current code,
but that still equates to a lot of memory used for he nodes; but there
currently is no limit to the memory used for the backing data.
This could cause problems with malformed or malicious input data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
