Skip to content

Security: Prevent DoS from hashmap collisions #1748

Closed as not planned
Closed as not planned
@turnidge

Description

@turnidge

DoS using hashmap collisions
dart/runtime/vm/object.cc
6156 hash_ += ch;
6157 hash_ += hash_ << 10;
6158 hash_ ^= hash_ >> 6;
hash(attacker-supplied data) can be predicted
if hashmap is used on attacker-supplied keys, attacker can cause O(n^2) operations on the hashmap
background: http://www.youtube.com/watch?v=R2Cq3CLI6H8
solution: follow-up with Erik / apply same counter measures as V8

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-metaCross-cutting, high-level issues (for tracking many other implementation issues, ...).closed-staleClosed as the issue or PR is assumed staletype-bugIncorrect behavior (everything from a crash to more subtle misbehavior)type-security

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions