File size: 1,922 Bytes
9c5cf24 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 | ---
tags:
- security
- proof-of-concept
- protobuf
license: mit
---
# Protocol Buffers ExtensionRangeOptions uninterpreted_option materialization DoS PoC
This repository contains a benign security research PoC for a `.pb` artifact
that drives repeated-message materialization during
`descriptor_pb2.ExtensionRangeOptions.ParseFromString(...)`.
Files:
- `control_one_extensionrange_uninterpreted_option.pb`
- `malicious_extensionrange_uninterpreted_option_5000000.pb`
- `reproduce.py`
Observed behavior:
- control artifact:
- parses successfully with one `uninterpreted_option` entry
- malicious artifact:
- parses successfully with `5,000,000` `uninterpreted_option` entries
- materially increases peak RSS during normal parse
Tested runtime:
```bash
python3 -m pip install protobuf==7.35.1
```
Public reproduction:
```bash
curl -L -O https://huggingface.co/hacnho/protobuf-extensionrangeoptions-uninterpreted-option-dos-poc/resolve/main/control_one_extensionrange_uninterpreted_option.pb
curl -L -O https://huggingface.co/hacnho/protobuf-extensionrangeoptions-uninterpreted-option-dos-poc/resolve/main/malicious_extensionrange_uninterpreted_option_5000000.pb
curl -L -O https://huggingface.co/hacnho/protobuf-extensionrangeoptions-uninterpreted-option-dos-poc/resolve/main/reproduce.py
python3 reproduce.py --control control_one_extensionrange_uninterpreted_option.pb --malicious malicious_extensionrange_uninterpreted_option_5000000.pb
```
Public files:
- `https://huggingface.co/hacnho/protobuf-extensionrangeoptions-uninterpreted-option-dos-poc/resolve/main/control_one_extensionrange_uninterpreted_option.pb`
- `https://huggingface.co/hacnho/protobuf-extensionrangeoptions-uninterpreted-option-dos-poc/resolve/main/malicious_extensionrange_uninterpreted_option_5000000.pb`
- `https://huggingface.co/hacnho/protobuf-extensionrangeoptions-uninterpreted-option-dos-poc/resolve/main/reproduce.py`
|