Repository navigation

Bound decoder work to prevent a pointer fan-out DoS (STF-1570) - #281

Merged

horgh merged 13 commits into

mainfrom

Sep 10, 2026

Merged

Bound decoder work to prevent a pointer fan-out DoS (STF-1570)#281
horgh merged 13 commits into
mainfrom
greg/stf-1488

Commits on Sep 8, 2026
- Bound decoder work to prevent a pointer fan-out denial of service
  
  oschwald
  and
  claude
  committed
  f15a433
- Bound decoder payload to stop an amplification denial of service
  
  oschwald
  and
  claude
  committed
  753d614
- Exercise the shared fan-out and value-limit fixtures
  
  oschwald
  and
  claude
  committed
  9b474f5
- Bump libmaxminddb to pick up the decoder resource limits
  
  oschwald
  and
  claude
  committed
  cef34e7
- Keep the decode budgets on the decoder instance
  
  oschwald
  and
  claude
  committed
  91cf91b
- Reduce stream calls in the pure PHP reader
  
  oschwald
  and
  claude
  committed
  5658655
Commits on Sep 9, 2026
- Reject pointers that directly target another pointer
  oschwald
  committed
  3241a02
- Reject nested lookups on the same reader
  oschwald
  committed
  bca4e14
- Test a string exactly one byte over the payload limit
  oschwald
  committed
  b5759a9
- Test decoder state reset between calls
  oschwald
  committed
  8451e5b
- Use section-neutral decoder limit errors
  oschwald
  committed
  109614d
- Declare the PHP 8 test polyfill directly
  oschwald
  committed
  8e829f5
- Clarify decoder limit and stream comments
  oschwald
  committed
  87b1147