You can deploy this model and start earning money today!

hacnho/
protobuf-usage-requirements-dos-poc

Views

No views yet

Protocol Buffers Usage requirements materialization DoS PoC

This repository contains a benign security research PoC for a protobuf binary artifact that drives large repeated-string materialization during google.api.usage_pb2.Usage.ParseFromString(...).

Files:

control_one_channel.pb
malicious_requirements_5000000.pb
reproduce.py

Observed behavior:

control artifact:
- parses successfully with zero requirements entries
malicious artifact:
- both files are 10,000,000 bytes
- parses successfully with 5,000,000 requirements entries
- increases peak RSS by about 200196 kB in local clean-process replay
- takes about 17.25x the control parse time

Tested runtime:

protobuf==7.35.1
Python: /usr/bin/python3

Public files:

https://huggingface.co/hacnho/protobuf-usage-requirements-dos-poc/resolve/main/control_one_channel.pb
https://huggingface.co/hacnho/protobuf-usage-requirements-dos-poc/resolve/main/malicious_requirements_5000000.pb
https://huggingface.co/hacnho/protobuf-usage-requirements-dos-poc/resolve/main/reproduce.py

Reproduction:

python3 reproduce.py

hacnho/protobuf-usage-requirements-dos-poc

Protocol Buffers Usage requirements materialization DoS PoC

hacnho/
protobuf-usage-requirements-dos-poc