Security issue in Java based server

[tigerw]

Sadly, I know nothing John Snow, er I mean, of how to work it. Hope you all on the team find it's not too much hassle.

References.

[xoft]

Recursion depth alone won't prevent this attack - it has a maximum depth of 6, which is a perfectly reasonable NBT depth. And again, what maximum size to choose for the uncompressed packets?

[worktycho]

Well since we limit packet size to 32 KiB I suggest 512 KiB as a limit. Most non-pathological structured data has a less than 10:1 compression ratio so having a limit of 16 times compressed size seems reasonable. Limiting this in the NBT parser could be as simple as limiting the size of cFastNBT::m_Tags to a sensible value. Can I suggest 1,000?

Recursion depth for NBT was more of a general issue as if you can jump the guard page it allows the attacker to write arbitrary data to memory.