Bound decoded values to prevent a pointer fan-out DoS (STF-1568) - #479

Merged

horgh merged 17 commits into

mainfrom

Sep 4, 2026

Commits on Sep 3, 2026

Bound decoded values to prevent a pointer fan-out denial of service

oschwald
and
claude
committed
70d3862
Bound the total payload decoded for a single entry

oschwald
and
claude
committed
3d8b5ec
Update the test-data submodule for the pointer DoS fixtures

oschwald
and
claude
committed
044c3c2
Add regression tests for the decoder resource limits

oschwald
and
claude
committed
b7dc5ab
Add braces to the single-line if statements in the fuzz harness

oschwald
and
claude
committed
27d6997
Use snprintf for the fuzz harness file name

oschwald
and
claude
committed
12537f3
Fuzz MMDB_get_entry_data_list in the fuzz harness

oschwald
and
claude
committed
1ca2612
Refer to the merged Reader Resource Limits section

oschwald
and
claude
committed
8c2a60a
Report the nesting depth limit as a decoder limit

oschwald
and
claude
committed
f64beda
Fix data pool test under NDEBUG
oschwald
committed
5fb2ce5
Improve decoder limit override tests
oschwald
committed
ea62fc2
Harden fuzz harness file handling
oschwald
committed
5509ed3
Clarify decoder limit documentation
oschwald
committed
5017610
Rename the private decoder state type
oschwald
committed
3bb02c0
Keep the data pool size parameter const
oschwald
committed
ed6a893
Avoid a shell in compiler detection
oschwald
committed
f5fd27d

Commits on Sep 4, 2026

Clarify the decoder depth limit wording
oschwald
committed
5741fff