[jira] [Commented] (PROTON-2968) pn_decoder_decode rejects compound counts too large for the node array

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PROTON-2968?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115328#comment-18115328 ] 

ASF subversion and git services commented on PROTON-2968:
---------------------------------------------------------

Commit 040c0993f3b85205607740f2c847ea7ef754693d in qpid-proton's branch refs/heads/main from Andrew Stitcher
[ https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=040c0993f ]

PROTON-2968: pn_decoder_decode rejects too large compound counts

Elements of a zero width type (null, true, ...) take up no input bytes at all, so the child count together with the input size in an array of these does not bound the size of the decoded array.

A compound with more children than the allowed number of nodes in a pn_data_t couldn't fit in the node array, so reject the count outright with PN_OUT_OF_MEMORY, which is what a decode that ran out of nodes would report anyway.

Assisted-By: Claude Opus 5 <no...@anthropic.com>


> pn_decoder_decode rejects compound counts too large for the node array
> ----------------------------------------------------------------------
>
>                 Key: PROTON-2968
>                 URL: https://issues.apache.org/jira/browse/PROTON-2968
>             Project: Qpid Proton
>          Issue Type: Bug
>          Components: proton-c
>            Reporter: Andrew Stitcher
>            Assignee: Andrew Stitcher
>            Priority: Major
>             Fix For: proton-c-0.41.0
>
>
> Elements of a zero width type (null, true, ...) take up no input bytes at
> all, so the count in an array header is not bounded by the size the header
> declares, the way a list's would be.
> No array with a count larger than the maximum allowed would be decoded into the node array, so reject the count outright as soon as the header is read, with PN_OUT_OF_MEMORY - which is what a decode that ran out of nodes would report anyway.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org