hacnho/protobuf-methodsettings-auto-populated-fields-dos-poc

Protocol Buffers MethodSettings auto_populated_fields materialization DoS PoC

This repository contains a benign security research PoC for a .pb artifact that drives repeated-string materialization during client_pb2.MethodSettings.ParseFromString(...).

Files:

• control_one_auto_populated_field.pb
• malicious_auto_populated_fields_5000000.pb
• reproduce.py

Exact public file URLs:

• https://huggingface.co/hacnho/protobuf-methodsettings-auto-populated-fields-dos-poc/resolve/main/control_one_auto_populated_field.pb
• https://huggingface.co/hacnho/protobuf-methodsettings-auto-populated-fields-dos-poc/resolve/main/malicious_auto_populated_fields_5000000.pb
• https://huggingface.co/hacnho/protobuf-methodsettings-auto-populated-fields-dos-poc/resolve/main/reproduce.py

Expected signal:

• control:
  • auto_populated_fields_len = 1
  • first_auto_populated_field_len = 9999995
• malicious:
  • auto_populated_fields_len = 5000000
• latest local replay:
  • vmhwm_delta_kb = 199720
  • elapsed_ratio = 11.34
• latest public replay:
  • vmhwm_delta_kb = 199584
  • elapsed_ratio = 10.91