On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
> I am using gambit to write a client/server application. I am *very*
> tempted to just use the read and write functions provided with gambit
> for the protocol. I don't think this is a problem sense the resulting
> forms will never be evaled. However, there is one issue and that is if
> an attacker pumps a *very* large sexpr into the server filling
> available memory.
I believe that gambit interns all symbols from a read, so an attacker
can simply send multiple different symbols until your memory is
exhausted.
Brad