File size: 684 Bytes
11e2a1a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | ---
tags:
- security
- proof-of-concept
- protobuf
license: mit
---
# Protocol Buffers FieldMask paths materialization DoS PoC
This repository contains a benign security research PoC for a `.pb` artifact
that drives repeated-string materialization during
`field_mask_pb2.FieldMask.ParseFromString(...)`.
Files:
- `control_one_path.pb`
- `malicious_paths_5000000.pb`
- `reproduce.py`
Observed behavior:
- control artifact:
- parses successfully with one `paths` entry
- malicious artifact:
- parses successfully with `5,000,000` `paths` entries
- materially increases peak RSS during normal parse
Tested runtime:
```bash
python3 -m pip install protobuf==7.35.1
```
|