From 7be9d99d1536c8a9e09897919d4e174a2ebce511 Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Thu, 17 Oct 2024 20:28:46 +0200 Subject: [PATCH] Restrict atom count in deserializer to 1 million Otherwise it's too easy to tie up too many resources (cpu, memory) by crafting inputs with a very large atom count (up to 4 billion.) This may need some finetuning. If the limit proves too restrictive for very large snapshots, we can make it relative to the size of the input. --- quickjs.c | 7 ++++++- tests/test_bjson.js | 1 + 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/quickjs.c b/quickjs.c index 90e9729..4f4fc95 100644 --- a/quickjs.c +++ b/quickjs.c @@ -35571,8 +35571,13 @@ static int JS_ReadObjectAtoms(BCReaderState *s) } if (bc_get_leb128(s, &s->idx_to_atom_count)) return -1; + if (s->idx_to_atom_count > 1000*1000) { + JS_ThrowInternalError(s->ctx, "unreasonable atom count: %u", + s->idx_to_atom_count); + return -1; + } - bc_read_trace(s, "%d atom indexes {\n", s->idx_to_atom_count); + bc_read_trace(s, "%u atom indexes {\n", s->idx_to_atom_count); if (s->idx_to_atom_count != 0) { s->idx_to_atom = js_mallocz(s->ctx, s->idx_to_atom_count * diff --git a/tests/test_bjson.js b/tests/test_bjson.js index c1f72bb..9409676 100644 --- a/tests/test_bjson.js +++ b/tests/test_bjson.js @@ -231,6 +231,7 @@ function bjson_test_fuzz() { var corpus = [ "EBAAAAAABGA=", + "EObm5oIt", ]; for (var input of corpus) { var buf = base64decode(input);