Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): can allocate memory for incoming messages well above configured limits #7

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

lamcodeofpwnosec
Copy link

There are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option:

  1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.
  2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.

Checklist

  • App update process has been followed
  • Target branch is develop
  • Application version has been bumped

@lamcodeofpwnosec lamcodeofpwnosec changed the title fix(grpc-js): can allocate memory for incoming messages well above configured limits fix(deps): can allocate memory for incoming messages well above configured limits Jan 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants