You can deploy this model and start earning money today!

hacnho/
protobuf-documentation-pages-dos-poc

Views

No views yet

Protocol Buffers Documentation pages materialization DoS PoC

This repository contains a benign security research PoC for a protobuf binary artifact that drives large repeated-message materialization during google.api.documentation_pb2.Documentation.ParseFromString(...).

Files:

control_one_summary.pb
malicious_pages_5000000.pb
reproduce.py

Observed behavior:

control artifact:
- parses successfully with zero pages entries
malicious artifact:
- both files are 10,000,000 bytes
- parses successfully with 5,000,000 pages entries
- increases peak RSS by about 330316 kB in local clean-process replay
- takes about 19.05x the control parse time

Tested runtime:

protobuf==7.35.1
Python: /usr/bin/python3

Public files:

https://huggingface.co/hacnho/protobuf-documentation-pages-dos-poc/resolve/main/control_one_summary.pb
https://huggingface.co/hacnho/protobuf-documentation-pages-dos-poc/resolve/main/malicious_pages_5000000.pb
https://huggingface.co/hacnho/protobuf-documentation-pages-dos-poc/resolve/main/reproduce.py

Reproduction:

python3 reproduce.py

hacnho/protobuf-documentation-pages-dos-poc

Protocol Buffers Documentation pages materialization DoS PoC

hacnho/
protobuf-documentation-pages-dos-poc