Encoding objects leak memory if decoding fails

[kraih]

Hi,

We recently got a report about a memory leak in Mojolicious, and i've been able to track it down to our use of encoding objects. Here's a minimal test case to replicate the problem.

use 5.16.0;
use Encode 'find_encoding';

my $encoding = find_encoding 'UTF-8';
my $invalid  = "\x89";

for (1 .. 100000000) {
  say $_;
  eval { $encoding->decode($invalid, 1); 1 };
}

Tested on OS X 10.8.2 with Perl 5.16.2 and Encode 2.48.

[chansen]

I have fixed this issue in my fork of p5-encode, https://github.com/chansen/p5-encode/commit/c0aaf6c930e6a0530184bcbcfaa5a98dc8d8c772.

chansen

[kraih]

Here's also a oneliner to demonstrate the issue.

perl -MEncode=decode -E 'eval { decode("UTF-8", "\x89", 1) } while 1'

Hope the fix by @chansen gets applied quickly, it's not very hard to exploit this for DoS attacks.

[dankogai]

Thank you folks, especially chansen@c00aaf6c . My github repo is fixed accodingly and offical VERSION++ soon to follow.

Dan the Maintainer Thereof