Verify stream size before allocating string / bytes.
This stops ridicuously large mallocs from getting through
on length-limited streams or buffers. Typically you should
also override realloc() to limit allocation size yourself
if dealing with untrusted data in pointer mode, but this
at least limits the potential denial-of-service attacks.
diff --git a/pb_decode.c b/pb_decode.c
index e2574d7..5085d20 100644
--- a/pb_decode.c
+++ b/pb_decode.c
@@ -1522,6 +1522,9 @@
#ifndef PB_ENABLE_MALLOC
PB_RETURN_ERROR(stream, "no malloc support");
#else
+ if (stream->bytes_left < size)
+ PB_RETURN_ERROR(stream, "end-of-stream");
+
if (!allocate_field(stream, field->pData, alloc_size, 1))
return false;
dest = *(pb_bytes_array_t**)field->pData;
@@ -1561,6 +1564,9 @@
#ifndef PB_ENABLE_MALLOC
PB_RETURN_ERROR(stream, "no malloc support");
#else
+ if (stream->bytes_left < size)
+ PB_RETURN_ERROR(stream, "end-of-stream");
+
if (!allocate_field(stream, field->pData, alloc_size, 1))
return false;
dest = *(pb_byte_t**)field->pData;
