starwing / lua-protobuf / 28255608145

100%

push

github

fix: add recursion depth limit for message decoding

This commit addresses the DoS vulnerability caused by unbounded mutual
recursion when processing deeply nested unknown SGROUP/EGROUP tags or
length delimited messages.

This fix introduces a predefined recursion limit macro (default 1000)
when decode nest messages (lpbD_message).  Deeply nested message from
untrusted input will now be rejected with an error instead of exhausting
the C stack.

Special thanks to Brian Lee, from Team Atlanta, for his patient and
detailed vulnerability report, as well as his thorough code review of
the initial fix – his feedback was invaluable in shaping the final
solution.

29 of 29 new or added lines in 2 files covered. (100.0%)

2019 of 2026 relevant lines covered (99.65%)

4826.61 hits per line