Several deserialization functions trust length/count fields from the wire without validating them against the available data or a global cap:
delta_signature_deserialize() (src/shared/delta.c:86-124) reads block_count and allocates block_count * sizeof(DeltaBlockSig) without a cap.
delta_deserialize() (src/shared/delta.c:322-421) reads instruction_count and allocates instruction_count * sizeof(DeltaInstruction) without a cap.
chunk_deserialize() (src/shared/chunk.c:86-183) reads path_len and file_data_size as size_t from the chunk payload and allocates them directly.
A malicious peer can craft small payloads with huge counts/sizes, causing OOM or allocation failures that are not handled gracefully.
Suggested fix
Define a maximum number of blocks, instructions, files per chunk, and file/path size.
Validate every length/count field against the remaining buffer size before allocating.
Return NULL and log an error on malformed input.
Severity
Medium
Category
security
This issue was automatically generated by the issue-creator agent.
## Description
Several deserialization functions trust length/count fields from the wire without validating them against the available data or a global cap:
- `delta_signature_deserialize()` (`src/shared/delta.c:86-124`) reads `block_count` and allocates `block_count * sizeof(DeltaBlockSig)` without a cap.
- `delta_deserialize()` (`src/shared/delta.c:322-421`) reads `instruction_count` and allocates `instruction_count * sizeof(DeltaInstruction)` without a cap.
- `chunk_deserialize()` (`src/shared/chunk.c:86-183`) reads `path_len` and `file_data_size` as `size_t` from the chunk payload and allocates them directly.
A malicious peer can craft small payloads with huge counts/sizes, causing OOM or allocation failures that are not handled gracefully.
## Suggested fix
1. Define a maximum number of blocks, instructions, files per chunk, and file/path size.
2. Validate every length/count field against the remaining buffer size before allocating.
3. Return `NULL` and log an error on malformed input.
## Severity
Medium
## Category
security
---
_This issue was automatically generated by the issue-creator agent._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
Several deserialization functions trust length/count fields from the wire without validating them against the available data or a global cap:
delta_signature_deserialize()(src/shared/delta.c:86-124) readsblock_countand allocatesblock_count * sizeof(DeltaBlockSig)without a cap.delta_deserialize()(src/shared/delta.c:322-421) readsinstruction_countand allocatesinstruction_count * sizeof(DeltaInstruction)without a cap.chunk_deserialize()(src/shared/chunk.c:86-183) readspath_lenandfile_data_sizeassize_tfrom the chunk payload and allocates them directly.A malicious peer can craft small payloads with huge counts/sizes, causing OOM or allocation failures that are not handled gracefully.
Suggested fix
NULLand log an error on malformed input.Severity
Medium
Category
security
This issue was automatically generated by the issue-creator agent.