Crap, if thats true then that even managing total input wont help there. Hmm, I guess I will need to write my own protocol handler.
On Sat, 27 Nov 2004 20:45:15 -0500, Bradley Lucier lucier@math.purdue.edu wrote:
On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
I am using gambit to write a client/server application. I am *very* tempted to just use the read and write functions provided with gambit for the protocol. I don't think this is a problem sense the resulting forms will never be evaled. However, there is one issue and that is if an attacker pumps a *very* large sexpr into the server filling available memory.
I believe that gambit interns all symbols from a read, so an attacker can simply send multiple different symbols until your memory is exhausted.
Brad