Re: [gambit-list] Using read in a networked environment
On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
I am using gambit to write a client/server application. I am *very* tempted to just use the read and write functions provided with gambit for the protocol. I don't think this is a problem sense the resulting forms will never be evaled. However, there is one issue and that is if an attacker pumps a *very* large sexpr into the server filling available memory.
I believe that gambit interns all symbols from a read, so an attacker can simply send multiple different symbols until your memory is exhausted. Brad
Afficher les réponses par date
Crap, if thats true then that even managing total input wont help there. Hmm, I guess I will need to write my own protocol handler. On Sat, 27 Nov 2004 20:45:15 -0500, Bradley Lucier <lucier@math.purdue.edu> wrote:
On Nov 26, 2004, at 6:03 PM, Eric Merritt wrote:
I am using gambit to write a client/server application. I am *very* tempted to just use the read and write functions provided with gambit for the protocol. I don't think this is a problem sense the resulting forms will never be evaled. However, there is one issue and that is if an attacker pumps a *very* large sexpr into the server filling available memory.
I believe that gambit interns all symbols from a read, so an attacker can simply send multiple different symbols until your memory is exhausted.
Brad
-- I'm a programmer, I don't have to spell correctly; I just have to spell consistently
participants (2)
-
Bradley Lucier -
Eric Merritt