Bound decoder work to prevent a pointer fan-out DoS (STF-1569) - #235

Merged

horgh merged 14 commits into

mainfrom

Sep 4, 2026

Commits on Sep 3, 2026

Bound decoder work to stop crafted-database denial of service

oschwald
and
claude
committed
661b89f
Allow the decoder limits to be changed per reader

oschwald
and
claude
committed
bf1dd31
Decode pointers with integer arithmetic

oschwald
and
claude
committed
3bb4095
Read single bytes without allocating a String

oschwald
and
claude
committed
bcd354f
Dispatch on the data type with a case statement

oschwald
and
claude
committed
ce6f774

Commits on Sep 4, 2026

Name decoder budget indices
oschwald
committed
2d13511
Stop passing unused scalar budgets
oschwald
committed
3e7e9c2
Reject pointers that target pointers
oschwald
committed
115f027
Make decoder limit tests deterministic
oschwald
committed
2e66eec
Test depth restoration between sibling containers
oschwald
committed
939f32d
Clarify decoder resource accounting
oschwald
committed
53a883c
Reject oversized integer encodings
oschwald
committed
c3cc04f
Reject truncated in-memory data
oschwald
committed
e67b3de
Make map budget test regression-sensitive
oschwald
committed
8816e5c