Unbounded memory allocation in header parsing

[sneurlax]

The helper Header::read and its buffered/async variants (fn read, fn read_async, fn read_buffered, and fn read_async_buffered) call the nom parser in a loop. When the parser returns Incomplete(Needed::Size(n)), the code blindly executes data.resize(m + n, 0) and then read_exact the additional bytes. Because n is attacker-influenced and no upper bound is enforced, a hostile file can force arbitrarily large allocations, leading to memory-exhaustion denial of service.

Recommendation:

Abort header parsing when the accumulated buffer exceeds 64 KiB (the limit used by the reference Go implementation) or a tighter value mandated by project policy. Propagate a DecryptError::InvalidHeaderSize to callers.

Chat Gpt agrees with you, that is 4 out of 4 that it aggress with you, very well done !!

In all four of the Header::read* variants (plain, buffered, async and async‑buffered), the loop looks roughly like this:
match read::header(&data) { Ok((_, mut header)) => return Ok(header), Err(nom::Err::Incomplete(nom::Needed::Size(n))) => { let m = data.len(); let new_len = m + n.get(); // no bound on n! data.resize(new_len, 0); input.read_exact(&mut data[m..new_len])?; } Err(_) => return Err(DecryptError::InvalidHeader), }

///

Because n comes directly from the parser’s Needed::Size, a maliciously truncated or malformed header could request an arbitrarily large n, driving data.resize(...) to allocate huge chunks of memory and crash the process (a memory exhaustion‑style DoS).

How it differs from the other memory‑DoS issue

This one is about unbounded resizing when parsing the file header.

Recommended fix
Before you do the resize, check:

if data.len() + n.get() > MAX_HEADER_SIZE {
return Err(DecryptError::InvalidHeaderSize);
}

For compatibility with other implementations, MAX_HEADER_SIZE could be 64 KiB (as in Go’s reference), or even tighter if your policy demands it. This way the parser safely aborts on oversized headers rather than exhausting memory.

Anyways, the high end (200 usd a month version) of chat gpt totally aggress with all 4 of your issues, very well done.