Hacker News Reader

Comment by tlb | Hacker News Reader

Keep in mind that many pieces of software are not intended to be resistant to DoS vulnerabilities. For example, any C++ compiler can be made to use exponentially large amounts of memory and CPU time by feeding it a specially crafted program; this is not normally considered a DoS vulnerability because you aren't supposed to feed untrusted input to your compiler.

View on HN

> any C++ compiler can be made to use exponentially large amounts of memory and CPU time by feeding it a specially crafted program

Doesn’t even need to be specially crafted, I wrote a <100 line C++ program to solve a Project Euler problem just yesterday that runs in 0.5s with ~2.5GB of RAM but takes clang++ 50GB of RAM to compile. I could easily tweak a param to make it use any multiple of that to exhaust the RAM on any workstation. Surprised me a bit honestly.

Off-topic:

C++ Newbie here!

I would like to see that code and its tweaked version. If at all possible.

Quick way to do it would be to calculate some high index in a fibbonacci sequence at compile time using templates.

I think this might be considered a bug if it's a reasonable program

Probably just over-(ab)use of templates. :)

My program’s much more mundane than using templates as a Turing complete language at compile time. Just a slightly tricky static node pool for a persistent segment tree. Allocating a larger pool causes more RAM usage at compile time, at a 20+x ratio. Probably not gonna share code since I didn’t bother to distill it down to the cause.

+1 on this. DOS are usually not considered security vulnerabilities. There is really no need to go to extreme length to keep one confidential. Just fill a github issue in the project.

Security vulnerability or not, it's still a DOS. Imagine having just a few requests (like less than 10) to your site consume 100% CPU until the server process is killed or restarted.

It depends on the exploit but DOS ARE security vulnerabilities and their impact can range from very low to high severity.

And please OP don't listen to this and report the vulnerability responsibly even if you're not so sure if it's a security vulnerability or not

Reply on news.ycombinator.com