Medium, CVSS 5.3crates.ioPublished
codeq: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)
- Affected
- crates.io codeq >= 0.0.0-0, < 0.6.3
- Fixed in
- 0.6.3· Vendor fix available
- Issue
- `codeq` is a serialization library whose `Decode` trait reads length-prefixed values. For `String` and `Vec `, the length-prefixed `Decode` implementations read a 4-byte big-endian length and allocate a buffer of that size before reading the payload. Because the declared length is taken straight from the input with no upper bound and no cross-check against the bytes actually available, a tiny input can force an allocation of up to ~4 GiB. Code that decodes untrusted data through `codeq` can therefore be made to spike memory use and be OOM-killed (CWE-400, uncontrolled resource consumption). The affected path, in `src/codec/impls/string_impl.rs`: ```rust impl Decode for String { fn decode (mut r: R) -> Result { let len = r.read_u32:: ()? as usize; let mut buf = vec![0; len]; // allocates `len` bytes up front r.read_exact(&mut buf)?; String::from_utf8(buf).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e)) } } ``` Any code that decodes attacker-controlled bytes through…
Recommended action: Upgrade to 0.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.