Views
No views yet
surrealml-core SurMlFile::from_file allocates an attacker-controlled amount
of memory (up to 4 GiB) based on an unvalidated 4-byte header length field,
before reading any of those bytes. A 5-byte malicious .surml file aborts the
process under a constrained memory limit.1python3 generate_poc_bug01.py # writes poc_bug01.surml (5 bytes)
2# build a tiny harness that calls SurMlFile::from_file(path)
3( ulimit -v 1048576; ./harness poc_bug01.surml ) # -> aborts (SIGABRT)memory allocation of 4294967295 bytes failed → abort (exit 134) under a 1GB/2GB
ulimit -v. See BUG01-actual-log.txt for full backtrace.