Skip to content

DOS in getNatural and getInteger

Currently, getNatural and getInteger don't have an upper size limit. They will continue parsing as long as there is new input to parse. This could lead to a Denial of Service situation if fed a sufficiently large input.

Proposal: Have getNatural and getInteger take a maximum number of bits/bytes, and fail parsing when exceeded.