Views
No views yet
.surml Denial of Service PoCSurMlFile::from_file()| File | Size | header_len claimed | Effect |
|---|---|---|---|
dos_4gb.surml | 8 bytes | 0xFFFFFFFF (~4 GiB) | OOM crash |
dos_256mb.surml | 8 bytes | 256 MiB | 256 MiB alloc |
modules/core/src/storage/surml_file.rs in from_file():1let integer_value = u32::from_be_bytes(buffer); // attacker-controlled
2// NO size guard:
3let mut header_buffer = vec![0u8; integer_value as usize]; // up to 4 GiB.surml file forces a 4 GiB heap allocation.1pip install surrealml
2python3 reproduce.py1const MAX_HEADER_SIZE: usize = 64 * 1024 * 1024;
2if integer_value as usize > MAX_HEADER_SIZE {
3 return Err(SurrealError::new("header too large".into(), ...));
4}