serde-bencode icon indicating copy to clipboard operation
serde-bencode copied to clipboard

OOM when parsing byte string with extremely long (incorrect) length

Open 5225225 opened this issue 3 years ago • 0 comments

use serde_bencode::value::Value;
use serde_bencode::from_bytes;

fn main() {
    let data = b"123456789123:1";
    let _: Result<Value, _> = from_bytes(data);
}

reproduced with git version (https://github.com/toby/serde-bencode/commit/553adb4be4962afcf30c79fe51b1ec191546c7b9) and latest crates.io (0.2.3).

The issue is the preallocation in

https://github.com/toby/serde-bencode/blob/553adb4be4962afcf30c79fe51b1ec191546c7b9/src/de.rs#L211-L222

specifically line 213

Probably best to just remove that preallocation. I'll make a PR to do that in a bit.

5225225 avatar Aug 19 '22 20:08 5225225