Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,46 @@
+---
+tags:
+  - security
+  - proof-of-concept
+  - protobuf
+license: mit
+---
+
+# Protocol Buffers MonitoredResourceDescriptor labels materialization DoS PoC
+
+This repository contains a benign security research PoC for a protobuf binary
+artifact that drives large repeated-message materialization during
+`google.api.monitored_resource_pb2.MonitoredResourceDescriptor.ParseFromString(...)`.
+
+Files:
+
+- `control_one_type.pb`
+- `malicious_labels_5000000.pb`
+- `reproduce.py`
+
+Observed behavior:
+
+- control artifact:
+  - parses successfully with zero `labels`
+  - `type_len = 9999995`
+- malicious artifact:
+  - both files are `10,000,000` bytes
+  - parses successfully with `5,000,000` `labels` entries
+  - increases peak RSS by about `330324 kB` in local clean-process replay
+
+Tested runtime:
+
+- `protobuf==7.35.1`
+- Python: `/usr/bin/python3`
+
+Public files:
+
+- `https://huggingface.co/hacnho/protobuf-monitoredresourcedescriptor-labels-dos-poc/resolve/main/control_one_type.pb`
+- `https://huggingface.co/hacnho/protobuf-monitoredresourcedescriptor-labels-dos-poc/resolve/main/malicious_labels_5000000.pb`
+- `https://huggingface.co/hacnho/protobuf-monitoredresourcedescriptor-labels-dos-poc/resolve/main/reproduce.py`
+
+Reproduction:
+
+```bash
+python3 reproduce.py
+```