On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
I am using gambit to write a client/server application. I am *very* tempted to just use the read and write functions provided with gambit for the protocol. I don't think this is a problem sense the resulting forms will never be evaled. However, there is one issue and that is if an attacker pumps a *very* large sexpr into the server filling available memory.
I believe that gambit interns all symbols from a read, so an attacker can simply send multiple different symbols until your memory is exhausted.
Brad
Afficher les réponses par date
Crap, if thats true then that even managing total input wont help there. Hmm, I guess I will need to write my own protocol handler.
On Sat, 27 Nov 2004 20:45:15 -0500, Bradley Lucier lucier@math.purdue.edu wrote:
On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
I am using gambit to write a client/server application. I am *very* tempted to just use the read and write functions provided with gambit for the protocol. I don't think this is a problem sense the resulting forms will never be evaled. However, there is one issue and that is if an attacker pumps a *very* large sexpr into the server filling available memory.
I believe that gambit interns all symbols from a read, so an attacker can simply send multiple different symbols until your memory is exhausted.
Brad
-
Bradley Lucier -
Eric Merritt