Unbounded vector growth in stanza collection

[sneurlax]

The Connection::unidir_receive function in the plugin-support crate (age-core/src/plugin.rs:229-279) appends every stanza to in-memory vectors with no upper bound. A misbehaving or malicious peer can stream arbitrary data and exhaust memory, leading to denial-of-service attacks.

Recommendation:

Impose hard per-phase caps (e.g., 1,024 stanzas or 8 MiB total) and abort on excess. The implementation should validate vector sizes before appending and return appropriate errors when limits are exceeded, preventing memory exhaustion while maintaining protocol compatibility.

WOW chatgpt (the 200 a month high end model) says your issue is correct, you are right. Very good catch.

Yes – the issue is spot‑on. In the current unidir_receive implementation, every stanza you receive is pushed into an in‑memory Vec with absolutely no limit:

pub fn unidir_receive(/* … */) -> UnidirResult { let mut res_a = Ok(vec![]); let mut res_b = Ok(vec![]); // … for stanza in iter::repeat_with(|| self.receive()) .take_while(|res| match res { Ok(stanza) => stanza.tag != COMMAND_DONE, _ => true, }) { let stanza = stanza?; fn validate<V>(val: Result<V, E>, res: &mut Result<Vec<V>, Vec<E>>) where V: Sized, E: Sized, { match val { Ok(a) => { if let Ok(stanzas) = res { stanzas.push(a) // ← unbounded push } } Err(e) => { /* … */ } } } // dispatch into res_a, res_b, etc. } Ok((res_a, res_b, /* … */)) }

Because there’s no cap on either the number of stanzas or the total bytes stored, a malicious or buggy plugin could stream thousands of stanzas (or dozens of MiB of data) and drive the process out of memory, resulting in a trivial denial‑of‑service.

Recommended fix:

Before appending to each vector, track:

Count of stanzas (e.g. reject when > 1 024),

Accumulated byte size of bodies (e.g. reject when > 8 MiB).

Bail out early with a clear error (e.g. io::ErrorKind::InvalidData) when any limit is hit.

This enforces a hard per‑phase cap while still reading legitimate protocol messages, preserving interoperability.

here is a better look at the code the code i posted is all lumped together