{"action":"created","issue":{"url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize/issues/115","repository_url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize","labels_url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize/issues/115/labels{/name}","comments_url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize/issues/115/comments","events_url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize/issues/115/events","html_url":"https://github.com/rust-lang-nursery/rustc-serialize/issues/115","id":83175899,"number":115,"title":"Having the length of a \"seq\" or \"map\" be tied to the allocated capacity is dangerous.","user":{"login":"TyOverby","id":573215,"avatar_url":"https://avatars.githubusercontent.com/u/573215?v=3","gravatar_id":"","url":"https://api.github.com/users/TyOverby","html_url":"https://github.com/TyOverby","followers_url":"https://api.github.com/users/TyOverby/followers","following_url":"https://api.github.com/users/TyOverby/following{/other_user}","gists_url":"https://api.github.com/users/TyOverby/gists{/gist_id}","starred_url":"https://api.github.com/users/TyOverby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TyOverby/subscriptions","organizations_url":"https://api.github.com/users/TyOverby/orgs","repos_url":"https://api.github.com/users/TyOverby/repos","events_url":"https://api.github.com/users/TyOverby/events{/privacy}","received_events_url":"https://api.github.com/users/TyOverby/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-31T20:12:41Z","updated_at":"2016-03-11T20:37:42Z","closed_at":null,"body":"For many decoders, (like JSON), calling `read_seq` with the length of items in a Json array or map is fine because the Json array or map is already in memory, so having a Vec or HashMap initialize `with_capacity` isn't that bad. \r\n\r\nHowever, in a bug found by @jmesmon, the [bincode](https://github.com/TyOverby/bincode) decoder can be [tricked into getting `Vec` to preallocate more memory than the system has, causing the program crash.](https://github.com/TyOverby/bincode/issues/41) I put in a lot of restrictions in Bincode to prevent DOS attacks, with the goal of being able to use Bincode on a public port for gamedev, but the automatic \"capacity is the same as length\" would let any attacker take down any program using bincode to decode.\r\n\r\nI've implemented a fix [here](https://github.com/TyOverby/rustc-serialize/commit/cb9dab6b4d4cb7518513537c52397e8d4fd40cd9).  This would be a breaking change for people that implement their own `Decoder`s because the type signature differs, but elements that are `Decodable` won't need to change.  Furthermore, the `#[derive(Decodable)]` plugin shouldn't need to change because it doesn't emit any `read_map` or `read_seq` calls."},"comment":{"url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize/issues/comments/195540975","html_url":"https://github.com/rust-lang-nursery/rustc-serialize/issues/115#issuecomment-195540975","issue_url":"https://api.github.com/repos/rust-lang-nursery/rustc-serialize/issues/115","id":195540975,"user":{"login":"alexcrichton","id":64996,"avatar_url":"https://avatars.githubusercontent.com/u/64996?v=3","gravatar_id":"","url":"https://api.github.com/users/alexcrichton","html_url":"https://github.com/alexcrichton","followers_url":"https://api.github.com/users/alexcrichton/followers","following_url":"https://api.github.com/users/alexcrichton/following{/other_user}","gists_url":"https://api.github.com/users/alexcrichton/gists{/gist_id}","starred_url":"https://api.github.com/users/alexcrichton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexcrichton/subscriptions","organizations_url":"https://api.github.com/users/alexcrichton/orgs","repos_url":"https://api.github.com/users/alexcrichton/repos","events_url":"https://api.github.com/users/alexcrichton/events{/privacy}","received_events_url":"https://api.github.com/users/alexcrichton/received_events","type":"User","site_admin":false},"created_at":"2016-03-11T20:37:42Z","updated_at":"2016-03-11T20:37:42Z","body":"This may end up just being something that's just a case of where serde is recommended over rustc-serialize, unfortunately."}}