zooqueenandHanzo Dev ec11283b34 fix(zap): bound element counts before make() to stop unbounded-alloc DoS ...

A decoded uint32 element count fed make([]T,count) before the per-element loop consumed any bytes, so a ~9-byte message with count=0xFFFFFFFF could drive a ~100GB allocation (OOM; the 16MB message cap and handler recover() do not bound it). Add Reader.ReadCount(), which rejects any count exceeding Remaining(), and use it in the 9 collection decoders across vm.go, sender.go, warp.go.

Co-authored-by: Hanzo Dev <[email protected]>

2026-06-06 18:39:05 -07:00

..

doc.go

Add ZAP wire protocol transport for VM communication

2026-01-24 11:39:40 -08:00

LLM.md

docs(zap): canonical TCP port 9999 documented

2026-05-06 10:37:28 -07:00

sender.go

fix(zap): bound element counts before make() to stop unbounded-alloc DoS

2026-06-06 18:39:05 -07:00

transport_test.go

Add ZAP wire protocol transport for VM communication

2026-01-24 11:39:40 -08:00

transport.go

zap: add NewListener so any net.Listener can serve ZAP

2026-05-06 12:50:29 -07:00

vm.go

fix(zap): bound element counts before make() to stop unbounded-alloc DoS

2026-06-06 18:39:05 -07:00

warp.go

fix(zap): bound element counts before make() to stop unbounded-alloc DoS

2026-06-06 18:39:05 -07:00

wire_test.go

Add ZAP wire protocol transport for VM communication

2026-01-24 11:39:40 -08:00

wire.go

fix(zap): bound element counts before make() to stop unbounded-alloc DoS

2026-06-06 18:39:05 -07:00