Bound decoder work to prevent a pointer fan-out DoS (STF-1570) - #281

Open

oschwald wants to merge 13 commits into

mainfrom

Commits on Sep 8, 2026

Bound decoder work to prevent a pointer fan-out denial of service

oschwald
and
claude
committed
f15a433
Bound decoder payload to stop an amplification denial of service

oschwald
and
claude
committed
753d614
Exercise the shared fan-out and value-limit fixtures

oschwald
and
claude
committed
9b474f5
Bump libmaxminddb to pick up the decoder resource limits

oschwald
and
claude
committed
cef34e7
Keep the decode budgets on the decoder instance

oschwald
and
claude
committed
91cf91b
Reduce stream calls in the pure PHP reader

oschwald
and
claude
committed
5658655

Commits on Sep 9, 2026

Reject pointers that directly target another pointer
oschwald
committed
3241a02
Reject nested lookups on the same reader
oschwald
committed
bca4e14
Test a string exactly one byte over the payload limit
oschwald
committed
b5759a9
Test decoder state reset between calls
oschwald
committed
8451e5b
Use section-neutral decoder limit errors
oschwald
committed
109614d
Declare the PHP 8 test polyfill directly
oschwald
committed
8e829f5
Clarify decoder limit and stream comments
oschwald
committed
87b1147