Skip to content

Eigen::deserialize does not check input length

What is the current bug behavior?

Eigen::deserialize() assumes the amount of available data specified in the header is always available. If the header contains wrong values, this function is going to almost always result in immediate segfaults.

What is the expected correct behavior?

Eigen::deserialize() should check if the amount of data available matches the amount of data to read, and returns nullptr if reading the needed data would go out of bound.

Anything else that might help

I was considering using this in a broader serialization library as it seems to be the official utility for serializing Eigen structures, but this API design is giving me pause.