Security: Unbounded network allocation allows denial-of-service #187

New Issue

2026-07-30T18:34:13+02:00

TapTap commented

2026-07-30 18:34:13 +02:00

Severity: high
Category: security
Location: src/shared/protocol.c:176, src/shared/chunk.c:160, src/shared/delta.c:111, src/shared/protocol.c:150

Description:
Multiple protocol deserialization paths allocate memory based on size or count fields received directly from the network peer without any upper bound:

receive_data() allocates malloc((size_t)size) where size is an 8-byte unsigned value from the wire.
receive_str() allocates malloc(size + 1) where size is a size_t from the wire.
chunk_deserialize() allocates malloc(file_data_size) from a received size field.
delta_signature_deserialize() allocates sig->block_count * sizeof(DeltaBlockSig) from a received count.
delta_deserialize() allocates delta->instruction_count * sizeof(DeltaInstruction) from a received count.

A malicious client can send a huge size/count and cause the server to allocate enormous memory, leading to OOM and denial of service. No authentication is required.

Suggested fix:
Add reasonable global and per-message bounds before allocation:

#define MAX_WIRE_SIZE (1ULL << 34)          // 16 GB
#define MAX_CHUNK_FILES 100000
#define MAX_DELTA_INSTRUCTIONS 10000000

Check size against MAX_WIRE_SIZE and available memory heuristics in receive_data/receive_str. Validate block/instruction counts against MAX_* limits in delta deserialization.

Labels: security, dos

**Severity:** high **Category:** security **Location:** `src/shared/protocol.c:176`, `src/shared/chunk.c:160`, `src/shared/delta.c:111`, `src/shared/protocol.c:150` **Description:** Multiple protocol deserialization paths allocate memory based on size or count fields received directly from the network peer without any upper bound: - `receive_data()` allocates `malloc((size_t)size)` where `size` is an 8-byte unsigned value from the wire. - `receive_str()` allocates `malloc(size + 1)` where `size` is a `size_t` from the wire. - `chunk_deserialize()` allocates `malloc(file_data_size)` from a received size field. - `delta_signature_deserialize()` allocates `sig->block_count * sizeof(DeltaBlockSig)` from a received count. - `delta_deserialize()` allocates `delta->instruction_count * sizeof(DeltaInstruction)` from a received count. A malicious client can send a huge size/count and cause the server to allocate enormous memory, leading to OOM and denial of service. No authentication is required. **Suggested fix:** Add reasonable global and per-message bounds before allocation: ```c #define MAX_WIRE_SIZE (1ULL << 34) // 16 GB #define MAX_CHUNK_FILES 100000 #define MAX_DELTA_INSTRUCTIONS 10000000 ``` Check `size` against `MAX_WIRE_SIZE` and available memory heuristics in `receive_data`/`receive_str`. Validate block/instruction counts against `MAX_*` limits in delta deserialization. **Labels:** security, dos

TapTap added the security needs-triage labels 2026-07-30 18:34:13 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:49:31 +02:00

fix: security issues #192 #191 #190 #189 #188 #187

TapTap referenced this issue from a commit

2026-07-30 19:05:21 +02:00

fix: security #192 #187, bugs #194 #193, quality #195, features #174-#186

TapTap referenced this issue

2026-07-30 19:15:40 +02:00

Batch fix: security, bugs, quality, and features (v2) #198

TapTap closed this issue

2026-07-30 19:38:27 +02:00