Test the extension rejects the decoder DoS fixtures

The existing resource-limit tests force MODE_MEMORY, so they cover only
the pure Python decoder. The C extension decodes through libmaxminddb,
which has its own copy of the limits, and nothing asserted that path
rejects the DoS fixtures.

Add extension-path checks that decode each DoS fixture through
MODE_MMAP_EXT and assert an InvalidDatabaseError. The limits live in
libmaxminddb, so the checks first probe a fixture one byte over the 2 MiB
payload limit, which is small and safe to decode. A libmaxminddb with the
fix rejects it with the decoder-limit message and the checks run; an older
one decodes it and the checks skip, rather than run the large DoS fixtures
through a decoder that would exhaust memory.

See GHSA-hj94-g986-h9r7.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: oschwald

tests/decoder_test.py

@@ -5,10 +5,15 @@
 import unittest
 from typing import TYPE_CHECKING, Any, ClassVar, cast
 
-from maxminddb import MODE_MEMORY, open_database
+from maxminddb import MODE_MEMORY, MODE_MMAP_EXT, open_database
 from maxminddb.decoder import Decoder
 from maxminddb.errors import InvalidDatabaseError
 
+try:
+    import maxminddb.extension as _extension
+except ImportError:
+    _extension = None  # type: ignore[assignment]
+
 if TYPE_CHECKING:
     from _typeshed import SizedBuffer
 
@@ -449,3 +454,72 @@ def test_normal_record_still_decodes(self) -> None:
         )
         self.assertEqual(record["utf8_string"], "unicode! ☯ - ♫")
         self.assertEqual(record["bytes"], b"\x00\x00\x00*")
+
+
+def _has_extension() -> bool:
+    return _extension is not None and hasattr(_extension, "Reader")
+
+
+# The patched libmaxminddb reports its decoder resource limits through this
+# text (MMDB_DECODER_LIMIT_ERROR). A libmaxminddb without the fix decodes the
+# DoS fixtures instead, so the tests below skip rather than run the extension's
+# decoder out of memory.
+_EXTENSION_LIMIT_MESSAGE = "exceeds the configured resource limits"
+
+
+@unittest.skipUnless(_has_extension(), "C extension not available")
+class TestExtensionResourceLimits(unittest.TestCase):
+    """DoS-fixture checks for the C extension's libmaxminddb decoder.
+
+    The extension decodes through libmaxminddb, so these limits live in that
+    library, not in the pure-Python decoder that TestDecoderResourceLimits
+    covers. The checks run only when the linked libmaxminddb enforces the
+    limits and skip otherwise; see setUp.
+    """
+
+    @staticmethod
+    def _lookup(filename: str, ip: str = "0.0.0.1") -> object:
+        # MODE_MMAP_EXT forces the C extension. Each DoS fixture resolves any
+        # IPv4 address to its single crafted record.
+        with open_database(
+            f"{_TEST_DATA_DIR}/{filename}",
+            mode=MODE_MMAP_EXT,
+        ) as reader:
+            return reader.get(ip)
+
+    def setUp(self) -> None:
+        # Probe with a fixture one byte over the 2 MiB payload limit. A patched
+        # libmaxminddb rejects it with the decoder-limit message. An older one
+        # decodes it, which is only about 2 MiB and so safe, but means the large
+        # DoS fixtures below would exhaust memory, so skip instead of running
+        # them.
+        try:
+            self._lookup("MaxMind-DB-test-decoder-payload-limit-over.mmdb")
+        except InvalidDatabaseError as exc:
+            if _EXTENSION_LIMIT_MESSAGE in str(exc):
+                return
+        self.skipTest(
+            "linked libmaxminddb predates the decoder resource limits "
+            "(needs the fix that adds MMDB_DECODER_LIMIT_ERROR)",
+        )
+
+    def test_pointer_fan_out_fixture_is_rejected(self) -> None:
+        # A full database whose record nests arrays of pointers to the level
+        # below, the classic 2**depth fan-out.
+        with self.assertRaisesRegex(InvalidDatabaseError, _EXTENSION_LIMIT_MESSAGE):
+            self._lookup("MaxMind-DB-test-pointer-decoder-dos.mmdb")
+
+    def test_payload_amplification_is_rejected(self) -> None:
+        # An array of 8,192 pointers to one 65,535-byte value.
+        with self.assertRaisesRegex(InvalidDatabaseError, _EXTENSION_LIMIT_MESSAGE):
+            self._lookup("MaxMind-DB-test-payload-amplification-dos.mmdb")
+
+    def test_payload_amplification_string_is_rejected(self) -> None:
+        # The UTF-8 string variant, so the string decode path is exercised.
+        with self.assertRaisesRegex(InvalidDatabaseError, _EXTENSION_LIMIT_MESSAGE):
+            self._lookup("MaxMind-DB-test-payload-amplification-dos-string.mmdb")
+
+    def test_payload_amplification_worst_case_is_rejected(self) -> None:
+        # 65,535 pointers to one 65,535-byte value, exactly the value limit.
+        with self.assertRaisesRegex(InvalidDatabaseError, _EXTENSION_LIMIT_MESSAGE):
+            self._lookup("MaxMind-DB-test-payload-amplification-dos-worst-case.mmdb")