Crap, if thats true then that even managing total input wont help there. Hmm, I guess I will need to write my own protocol handler. On Sat, 27 Nov 2004 20:45:15 -0500, Bradley Lucier <lucier@math.purdue.edu> wrote:
On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
I am using gambit to write a client/server application. I am *very* tempted to just use the read and write functions provided with gambit for the protocol. I don't think this is a problem sense the resulting forms will never be evaled. However, there is one issue and that is if an attacker pumps a *very* large sexpr into the server filling available memory.
I believe that gambit interns all symbols from a read, so an attacker can simply send multiple different symbols until your memory is exhausted.
Brad
-- I'm a programmer, I don't have to spell correctly; I just have to spell consistently