Summary
The HTTP-Redirect binding inflates the DEFLATE-compressed SAMLRequest/SAMLResponse into a buffer that grows without an output-size cap, so a small highly-compressible query can expand to a large allocation before any schema validation.
Where
src/binding.c, saml_binding_redirect_parse (current main, 7d88f4e): the inflate loop grows the output buffer whenever inflate reports Z_BUF_ERROR with avail_out == 0 (str_grow(&xml)), continuing until Z_STREAM_END. The growth is bounded only by process memory; there is no ceiling on the inflated size.
Impact
Memory-amplification DoS on the pre-authentication redirect endpoint. Measured: a ~68 KB compressed query inflates to ~50 MB (RSS +~51 MB, ~771x). nginx header/URI limits blunt but do not eliminate it, and several concurrent requests multiply the effect.
Reproducer
Craft a maximally compressible DEFLATE stream (e.g. a long run of a repeated byte) within the redirect query-size limit, URL-encode it as SAMLRequest, and send it to the login/logout redirect endpoint; observe peak RSS relative to the compressed size.
Note
Pre-existing (present in v0.2.5).
Suggested fix
Cap the inflated output at a sane maximum (a small multiple of a legitimate message, or an absolute limit) and return an error once exceeded, before schema validation.
Summary
The HTTP-Redirect binding inflates the DEFLATE-compressed
SAMLRequest/SAMLResponseinto a buffer that grows without an output-size cap, so a small highly-compressible query can expand to a large allocation before any schema validation.Where
src/binding.c,saml_binding_redirect_parse(currentmain, 7d88f4e): the inflate loop grows the output buffer wheneverinflatereportsZ_BUF_ERRORwithavail_out == 0(str_grow(&xml)), continuing untilZ_STREAM_END. The growth is bounded only by process memory; there is no ceiling on the inflated size.Impact
Memory-amplification DoS on the pre-authentication redirect endpoint. Measured: a ~68 KB compressed query inflates to ~50 MB (RSS +~51 MB, ~771x). nginx header/URI limits blunt but do not eliminate it, and several concurrent requests multiply the effect.
Reproducer
Craft a maximally compressible DEFLATE stream (e.g. a long run of a repeated byte) within the redirect query-size limit, URL-encode it as
SAMLRequest, and send it to the login/logout redirect endpoint; observe peak RSS relative to the compressed size.Note
Pre-existing (present in v0.2.5).
Suggested fix
Cap the inflated output at a sane maximum (a small multiple of a legitimate message, or an absolute limit) and return an error once exceeded, before schema validation.