You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Flatbuffers is able to encode a virtually unbounded of schema fields in a small buffer size. Verifying that many fields with the Flatbuffers verifier seems to result in potentially unlimited verification times, which is a denial of service risk.
The way to mitigate this risk is to pass an appropriate max_tables and/or max_depth limit to the Flatbuffers verifier.
See discussion in #9349 (comment) :
Flatbuffers is able to encode a virtually unbounded of schema fields in a small buffer size. Verifying that many fields with the Flatbuffers verifier seems to result in potentially unlimited verification times, which is a denial of service risk.
The way to mitigate this risk is to pass an appropriate max_tables and/or max_depth limit to the Flatbuffers verifier.
Reporter: Antoine Pitrou / @pitrou
Assignee: Antoine Pitrou / @pitrou
Related issues:
PRs and other links:
Note: This issue was originally created as ARROW-11559. Please see the migration documentation for further details.
The text was updated successfully, but these errors were encountered: