Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent RAM exhaustion #150

Merged
merged 1 commit into from
Sep 26, 2023
Merged

Prevent RAM exhaustion #150

merged 1 commit into from
Sep 26, 2023

Conversation

sunfish-shogi
Copy link
Contributor

@sunfish-shogi sunfish-shogi commented Sep 25, 2023 •
edited
Loading

This change prevents RAM exhaustion.

  • Limit first slice capacity in common marshaller.
    • Exclude mdat-box.
    • Will not limit for reallocation. (If requested length is larger than real remaining file size, return EOF error.)
  • Return an error if name length of hdlr-box is larger than 1024.

#149
#146

@sunfish-shogi sunfish-shogi self-assigned this Sep 25, 2023
@sunfish-shogi sunfish-shogi mentioned this pull request Sep 25, 2023
Closed
@sunfish-shogi sunfish-shogi merged commit 1261cd9 into master Sep 26, 2023
6 checks passed
@sunfish-shogi sunfish-shogi deleted the prevent-ram-exaustion branch September 26, 2023 10:07
aler9 added a commit to aler9/go-mp4 that referenced this pull request Sep 30, 2023
@aler9
Fix out-of-memory errors with mdat boxes and remove size-based checks
7f4fba0 
While patch abema#150 is able to prevent RAM exhaustion with the majority of
small, specially-crafted strings, it isn'effective against strings that
contain mdat boxes. A short string is able to cause RAM exhaustion by
setting the mdat box size to a big number.

This PR fixes the issue by replacing size-based checks with checks on
the effective size of the underlying buffer, that are performed by
using Seek(). In this way, an attacker may cause DoS errors if and only
if he is able to upload an amount of data equal to the size of the RAM
of the machine, and if there are no size checks before passing the
buffer to ReadBoxStructure() or Unmarshal().

Size-based checks are performed only in case of non-uint8 slices, since
it's not possible to know in advance the overall size of a generic
slice.
@aler9 aler9 mentioned this pull request Sep 30, 2023
Merged
aler9 added a commit to aler9/go-mp4 that referenced this pull request Oct 1, 2023
@aler9
Fix out-of-memory errors with mdat boxes and remove size-based checks
22a1d29 
While patch abema#150 is able to prevent RAM exhaustion with the majority of
small, specially-crafted strings, it isn'effective against strings that
contain mdat boxes. A short string is able to cause RAM exhaustion by
setting the mdat box size to a big number.

This PR fixes the issue by replacing size-based checks with checks on
the effective size of the underlying buffer, that are performed by
using Seek(). In this way, an attacker may cause DoS errors if and only
if he is able to upload an amount of data equal to the size of the RAM
of the machine, and if there are no size checks before passing the
buffer to ReadBoxStructure() or Unmarshal().

Size-based checks are performed only in case of non-uint8 slices, since
it's not possible to know in advance the overall size of a generic
slice.
aler9 added a commit to aler9/go-mp4 that referenced this pull request Oct 1, 2023
@aler9
Fix out-of-memory errors with mdat boxes and remove size-based checks
2c7a537 
While patch abema#150 is able to prevent RAM exhaustion with the majority of
small, specially-crafted strings, it isn'effective against strings that
contain mdat boxes. A short string is able to cause RAM exhaustion by
setting the mdat box size to a big number.

This PR fixes the issue by replacing size-based checks with checks on
the effective size of the underlying buffer, that are performed by
using Seek(). In this way, an attacker may cause DoS errors if and only
if he is able to upload an amount of data equal to the size of the RAM
of the machine, and if there are no size checks before passing the
buffer to ReadBoxStructure() or Unmarshal().

Size-based checks are performed only in case of non-uint8 slices, since
it's not possible to know in advance the overall size of a generic
slice.
aler9 added a commit to aler9/go-mp4 that referenced this pull request Oct 1, 2023
@aler9
Fix out-of-memory errors with mdat boxes and remove size-based checks
eceb0a1 
While patch abema#150 is able to prevent RAM exhaustion with the majority of
small, specially-crafted strings, it isn'effective against strings that
contain mdat boxes. A short string is able to cause RAM exhaustion by
setting the mdat box size to a big number.

This PR fixes the issue by replacing size-based checks with checks on
the effective size of the underlying buffer, that are performed by
using Seek(). In this way, an attacker may cause DoS errors if and only
if he is able to upload an amount of data equal to the size of the RAM
of the machine, and if there are no size checks before passing the
buffer to ReadBoxStructure() or Unmarshal().

Size-based checks are performed only in case of non-uint8 slices, since
it's not possible to know in advance the overall size of a generic
slice.
aler9 added a commit to aler9/go-mp4 that referenced this pull request Oct 1, 2023
@aler9
Fix out-of-memory errors with mdat boxes and remove size-based checks
483be13 
While patch abema#150 is able to prevent RAM exhaustion with the majority of
small, specially-crafted strings, it isn'effective against strings that
contain mdat boxes. A short string is able to cause RAM exhaustion by
setting the mdat box size to a big number.

This PR fixes the issue by replacing size-based checks with checks on
the effective size of the underlying buffer, that are performed by
using Seek(). In this way, an attacker may cause DoS errors if and only
if he is able to upload an amount of data equal to the size of the RAM
of the machine, and if there are no size checks before passing the
buffer to ReadBoxStructure() or Unmarshal().

Size-based checks are performed only in case of non-uint8 slices, since
it's not possible to know in advance the overall size of a generic
slice.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@sunfish-shogi sunfish-shogi

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sunfish-shogi