GO-2022-0963

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2022-0963

Import Source

https://vuln.go.dev/ID/GO-2022-0963.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2022-0963

Aliases

Published

2022-09-02T18:37:03Z

Modified

2024-05-20T16:03:47Z

Summary

Resource exhaustion in github.com/gagliardetto/binary

Details

A memory allocation vulnerability can be exploited to allocate arbitrarily large slices, which can exhaust available memory or crash the program.

When parsing data from untrusted sources of input (e.g. the blockchain), the length of the slice to allocate is read directly from the data itself without any checks, which could lead to an allocation of excessive memory.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2022-0963"
}

References

Affected packages

Go / github.com/gagliardetto/binary

Package

Name: github.com/gagliardetto/binary; View open source insights on deps.dev
Purl: pkg:golang/github.com/gagliardetto/binary

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.1

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "BaseVariant.UnmarshalBinaryVariant",
                "BinByteCount",
                "BorshByteCount",
                "CompactU16ByteCount",
                "Decoder.Decode",
                "Decoder.Discard",
                "Decoder.ReadInt64",
                "Decoder.ReadNBytes",
                "Decoder.ReadRustString",
                "Decoder.ReadTypeID",
                "Decoder.ReadUint64",
                "Decoder.decodeBin",
                "Decoder.decodeBorsh",
                "Decoder.decodeCompactU16",
                "Encoder.Encode",
                "Encoder.WriteFloat32",
                "Encoder.WriteFloat64",
                "Encoder.encodeBin",
                "Encoder.encodeBorsh",
                "Encoder.encodeCompactU16",
                "Int64.UnmarshalWithDecoder",
                "JSONFloat64.MarshalWithEncoder",
                "MarshalBin",
                "MarshalBorsh",
                "MarshalCompactU16",
                "MustBinByteCount",
                "MustBorshByteCount",
                "MustCompactU16ByteCount",
                "Uint64.UnmarshalWithDecoder",
                "UnmarshalBin",
                "UnmarshalBorsh",
                "UnmarshalCompactU16",
                "discardNBytes",
                "readNBytes"
            ],
            "path": "github.com/gagliardetto/binary"
        }
    ]
}