msgpack-c (msgpack/msgpack-c) unbounded allocation PoC
Proof-of-concept file for a huntr Model Format Vulnerability report against
msgpack/msgpack-c (c_master branch, the C reference implementation of
MessagePack, used directly via its public C API - not the Python bindings,
which add their own separate max_array_len/max_map_len safety limits not
present in the raw C library).
evil.msgpack is a 5-byte file: the array32 marker (0xdd) followed by a
4-byte big-endian count of 0xFFFFFFFF (4,294,967,295 elements).
template_callback_array (src/unpack.c + unpack_template.h) takes n
directly from the MSGPACK_CS_ARRAY_32 header (a raw uint32 from the input
bytes) and computes size_t size = n * sizeof(msgpack_object); ->
msgpack_zone_malloc(size). The only guard present
(#if SIZE_MAX == UINT_MAX) only applies on 32-bit builds; on 64-bit builds
there is no check at all. The maintainer left a /* FIXME security guard */
comment directly on this line, acknowledging the gap.
Verified live: compiled src/unpack.c/objectc.c/zone.c/version.c
directly from a fresh c_master clone with gcc -O0 (generated
sysdep.h/pack_template.h from the repo's own cmake/*.in templates,
substituting the little-endian values for this host - no functional code
was modified), then called msgpack_unpack_next() directly on the 5-byte
buffer under a 1.5GB ulimit -v cap:
ret=-2 (MSGPACK_UNPACK_NOMEM_ERROR)
This confirms the library attempts an allocation proportional to the declared 4.29-billion-element count from a 5-byte input, and fails cleanly under memory pressure (a DoS/OOM-class finding - malloc failure is handled without falling into undefined behavior, not a heap-overflow class bug).
Reachable via msgpack_unpack_next(), the library's documented public
unpacking entry point (per its own QUICKSTART-C.md examples) - not test-only
or internal code. No SECURITY.md exists on the repository.
Impact: Denial of Service - an attacker who can supply or influence a MessagePack-encoded input parsed directly with msgpack-c's C API can force a request to allocate tens of gigabytes from a 5-byte payload.