is deserializing untrusted buffers safe?

[andrewbanchich]

The official docs say:

Cap’n Proto has not yet undergone security review. It most likely has some vulnerabilities. You should not attempt to decode Cap’n Proto messages from sources you don’t trust at this time.

https://capnproto.org/cxx.html#security-tips

This is under the C++ section, and I'm assuming it's implementation-specific. Is the Rust implementation safe when deserializing untrusted buffers?

[dwrensha]

capnproto-rust uses a lot of unsafe code, so it's difficult to assert that it is truly "safe". What I can say is that I have run a lot of fuzz testing on it, and a decent number of people seem to be using it. It's designed to return errors on malformed inputs, so if something else happens (via e.g. out-of-bounds access) then that's a bug that I would urgently fix.

[andrewbanchich]

thank you!