receive_str() has no size limit — potential memory exhaustion DoS #72

New Issue

2026-07-20T17:14:37+02:00

TapTap commented

2026-07-20 17:14:37 +02:00

Description

In lines 150-164, reads a length from the wire and then allocates that many bytes:

A malicious (or buggy) sender could send a very large value (e.g., ), causing to either fail (hopefully) or cause the receiver to allocate enormous amounts of memory (if is close to , wraps to 0 on overflow, and returns a valid pointer).

Impact

An attacker controlling the server or a man-in-the-middle could crash or exhaust memory on the client or vice versa.

Location

Suggested Fix

Add a maximum reasonable string length check:

Severity

Medium

Category

Security

## Description In lines 150-164, reads a length from the wire and then allocates that many bytes: A malicious (or buggy) sender could send a very large value (e.g., ), causing to either fail (hopefully) or cause the receiver to allocate enormous amounts of memory (if is close to , wraps to 0 on overflow, and returns a valid pointer). ## Impact An attacker controlling the server or a man-in-the-middle could crash or exhaust memory on the client or vice versa. ## Location ## Suggested Fix Add a maximum reasonable string length check: ## Severity Medium ## Category Security

TapTap referenced this issue from a commit

2026-07-20 18:44:11 +02:00

fix: memory/null safety bugs — issues #74, #72, #69, #64, #60, #50, #49, #65

TapTap closed this issue

2026-07-20 18:44:16 +02:00

TapTap referenced this issue

2026-07-20 18:44:16 +02:00

Fix memory/null safety bugs (#74, #72, #69, #64, #60, #50, #49, #65) #80

TapTap referenced this issue from a commit

2026-07-20 18:56:39 +02:00

fix: memory/null safety bugs — issues #74, #72, #69, #64, #60, #50, #49, #65

TapTap referenced this issue from a commit