Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Slice Memory Allocation with Excessive Size Value in binary
Vulnerability Description
Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value, which can either exhaust available memory or crash the whole program. When using `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size. When `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the length of the slice was previously read directly from the data itself without any checks on the size of it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with excessive size value. Users should upgrade to `v0.7.1` or higher. A workaround is not to rely on the `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and checks the length of any slice.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Type
未经控制的内存分配
Vulnerability Title
Binary 资源管理错误漏洞
Vulnerability Description
Binary是gagliardetto个人开发者的一个库。用于 Borsh 和其他格式的编码/解码。 Binary 0.7.1之前版本存在安全漏洞。攻击者利用该漏洞在内存中分配具有（任意）过大大小值的切片，导致耗尽可用内存或使整个程序崩溃。
CVSS Information
N/A
Vulnerability Type
N/A