Skip to content

Commit b382f76

Browse files
committed
fix: assure excessive amounts of newlines can't lead to amplification.
Now we won't read more than 1024 newlines in a row, which leads to a protection from specifically crafted configuration files which can amplify themselves when large amounts of edits happen on them. If somebody where to create a lot of sections based on one that has a huge amount of newlines before it, this whitespace would be retained with each new section, causing huge files to be created in memory that cause great delays when writing the file back and re-reading it. Maybe there would have been a way to avoid copying excessive amounts of whitespace when altering a section, or maybe one could also have adjusted the fuzz-test that found it [1]. This would, however, have been much harder and time-consuming to implement for dubious value. [1]: https://oss-fuzz.com/testcase?key=6416843954782208
1 parent 2a663a0 commit b382f76

File tree

1 file changed

+1
-1
lines changed
  • gix-config/src/parse/nom

1 file changed

+1
-1
lines changed

gix-config/src/parse/nom/mod.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -368,7 +368,7 @@ fn take_spaces1<'i>(i: &mut &'i [u8]) -> PResult<&'i BStr, NomError<&'i [u8]>> {
368368
}
369369

370370
fn take_newlines1<'i>(i: &mut &'i [u8]) -> PResult<&'i BStr, NomError<&'i [u8]>> {
371-
repeat(1.., alt(("\r\n", "\n")))
371+
repeat(1..1024, alt(("\r\n", "\n")))
372372
.map(|()| ())
373373
.recognize()
374374
.map(bstr::ByteSlice::as_bstr)

0 commit comments

Comments
 (0)