Skip to content

Conversation

@wtn
Copy link
Contributor

@wtn wtn commented Nov 14, 2025

Prevents stack overflow DoS attacks by limiting recursion depth when parsing binary plists.

Changes

  • Add MAX_DEPTH constant (512 levels)
  • Thread depth parameter through recursive parsing methods
  • Raise CFFormatError when depth exceeds limit
  • Add tests for deeply nested arrays and dictionaries

Background

The binary parser had no recursion depth limiting, allowing attackers to craft deeply nested structures (2000+ levels) that would cause SystemStackError crashes.

Co-authored-by: Claude <noreply@anthropic.com>
@ckruse ckruse merged commit 5e2a13c into ckruse:master Nov 14, 2025
10 checks passed
@wtn wtn deleted the nested branch November 14, 2025 07:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants