paramiko/paramiko — pull request #116 by mvschaik (2012-11-30 14:23:09+00:00)
Title: Limit memory allocation of get_bytes to 1MB

If get_bytes() can pad unlimited, a RSA pub key could be crafted
that would allocate GB's of nulls, thereby forming a DoS-vector.

E.g. if the message would be '\x7f\xff\xff\xff...', get_string() could
throw a memory error or crash a system.