[Boost-bugs] [Boost C++ Libraries] #4257: Improving invalid signature detection in binary iarchive

Subject: [Boost-bugs] [Boost C++ Libraries] #4257: Improving invalid signature detection in binary iarchive
From: Boost C++ Libraries (noreply_at_[hidden])
Date: 2010-05-25 16:16:13

#4257: Improving invalid signature detection in binary iarchive
---------------------------------------------------+------------------------
 Reporter:  Gevorg Voskanyan <v_gevorg@…>          |       Owner:  ramey        
     Type:  Patches                                |      Status:  new          
Milestone:  To Be Determined                       |   Component:  serialization
  Version:  Boost 1.43.0                           |    Severity:  Problem      
 Keywords:  binary iarchive invalid signature      |  
---------------------------------------------------+------------------------
 Binary iarchive is supposed to throw invalid_signature archive_exception
 when the archive content doesn't start with the expected signature.
 However in some cases a different behavior is observed when trying to load
 from an invalid archive. For example, if the supposed signature size being
 read ends up a huge number (can easily happen trying to load from an
 arbitrary file not created with Boost.Serialization), the program spends a
 few seconds on line 111 of basic_binary_iprimitive.ipp (s.resize(l);)
 allocating a big chunk of memory to read the signature into, then tries to
 read that many bytes from the stream, which, assuming the file is not that
 large, reads less bytes than requested so it all ends up throwing
 archive_exception(stream_error) at basic_binary_iprimitive.hpp:164.
 Another example is when the 'signature size' being read happens to be a
 larger number still, then s.resize(l); throws std::bad_alloc when in fact
 the user would want to get archive_exception(invalid_signature) instead.

 Patch for archive/impl/basic_binary_iarchive.ipp against Boost 1.43 is
 attached which makes basic_binary_iarchive to consistently throw
 archive_exception(invalid_signature) when the archive content does not
 start with the expected signature.

-- 
Ticket URL: <https://svn.boost.org/trac/boost/ticket/4257>
Boost C++ Libraries <http://www.boost.org/>
Boost provides free peer-reviewed portable C++ source libraries.