Closed
Description
go version devel +8ea2438 Fri Apr 17 13:44:30 2015 +0300 linux/amd64
with https://go-review.googlesource.com/#/c/8942/ appled.
The following program consumes 2GB while the input is few bytes. I suspect it is possible to modify the input to force the program to allocate arbitrary amount of memory and run for arbitrary period of time.
Allocations happen while receiving a wire type (encoding/gob.(*Decoder).recvType).
package main
import (
"bytes"
"encoding/gob"
"encoding/hex"
)
type X struct {
}
func main() {
data, _ := hex.DecodeString("53ff8f03010106696e7075745401ff900001fc0701044d61786901040001044d" +
"696e6901040001044d61787501060001044d61786601080001044d696e660108" +
"0001044d617863010e0001044d696e63010e00000007ff9001fe0000")
s := ""
gob.NewDecoder(bytes.NewReader(data)).Decode(&s)
var b []byte
gob.NewDecoder(bytes.NewReader(data)).Decode(&b)
var f float64
gob.NewDecoder(bytes.NewReader(data)).Decode(&f)
var x X
gob.NewDecoder(bytes.NewReader(data)).Decode(&x)
}