MAX_DATA_SIZE = 1GB allows large memory allocation from network input #117

New Issue

2026-07-21T16:20:50+02:00

TapTap commented

2026-07-21 16:20:50 +02:00

Description

receive_data() accepts up to 1GB per message (MAX_DATA_SIZE = 1024*1024*1024 in protocol.c:195). An attacker can request a 1GB allocation, causing memory pressure. Combined with no connection limit, this is a significant DoS vector.

Location

src/shared/protocol.c:195, 201

How to trigger

Connect and send a crafted header with size = 0x40000000 (1GB). The server allocates 1GB for the message. With multiple connections, the server runs out of memory.

Suggested Fix

Reduce MAX_DATA_SIZE to a more reasonable value (e.g., 256MB). Additionally, add a per-connection memory usage cap. Consider using a sliding window or streaming approach for large data instead of pre-allocating.

Severity

medium

Sub-Agent

security-screener (SC-6)

This issue was automatically generated by the issue-creator agent.

## Description `receive_data()` accepts up to 1GB per message (`MAX_DATA_SIZE = 1024*1024*1024` in protocol.c:195). An attacker can request a 1GB allocation, causing memory pressure. Combined with no connection limit, this is a significant DoS vector. ## Location src/shared/protocol.c:195, 201 ## How to trigger Connect and send a crafted header with `size = 0x40000000` (1GB). The server allocates 1GB for the message. With multiple connections, the server runs out of memory. ## Suggested Fix Reduce `MAX_DATA_SIZE` to a more reasonable value (e.g., 256MB). Additionally, add a per-connection memory usage cap. Consider using a sliding window or streaming approach for large data instead of pre-allocating. ## Severity medium ## Category security ## Sub-Agent security-screener (SC-6) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:14 +02:00

TapTap commented

2026-07-29 18:27:32 +02:00