Skip to content

Forced the limits of max size#3422

Open
garvittsingla wants to merge 1 commit intoapache:mainfrom
garvittsingla:forcing-max-size-limits
Open

Forced the limits of max size#3422
garvittsingla wants to merge 1 commit intoapache:mainfrom
garvittsingla:forcing-max-size-limits

Conversation

@garvittsingla
Copy link

@garvittsingla garvittsingla commented Feb 25, 2026

Fixes #3408

  • Introduce guardrail fields in cpp/fory/serialization/config.h for maximum allowed string, list/vector, and map sizes during deserialization.
  • Enforce these limits in cpp/fory/serialization/collection_serializer.h and cpp/fory/serialization/map_serializer.h.
  • Return Error::invalid_data if a configured limit is exceeded when reading untrusted payloads.
  • Addresses risk of large allocations from untrusted string/map/list lengths.

This change improves protocol-aware safety for C++ deserialization by preventing excessive memory usage from malicious or malformed payloads.

Related: cpp/fory/serialization/config.h:31, collection_serializer.h:396, collection_serializer.h:719, map_serializer.h:541

Done all the things as mentioned in the issue and enforced a length check

@garvittsingla garvittsingla marked this pull request as draft February 25, 2026 20:27
@garvittsingla garvittsingla marked this pull request as ready for review February 25, 2026 20:28
@garvittsingla
Copy link
Author

test are failing , please help me , where am I wrong?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[C++] configurable size guardrails for untrusted payloads

1 participant