Skip to content

mutator: limit Any unpacking to the post-processing depth - #302

Open
radhika1314 wants to merge 1 commit into
google:masterfrom
radhika1314:any-unpack-depth
Open

radhika1314 wants to merge 1 commit into
google:masterfrom
radhika1314:any-unpack-depth

Conversation

@radhika1314

Copy link
Copy Markdown

Repro: build a google.protobuf.Any chain nested 20000 deep (about 900 KB on the wire) and pass it to Mutator::Fix, which LoadProtoInput runs on every input. On the current tree that takes 8.3 s and 1.9 GB of peak RSS; a 225 KB chain already needs 586 MB. The nested value is parsed as a fresh message at each level, so the parser recursion limit does not apply.
Cause: UnpackAny unpacks every level, and each unpacked level keeps a copy of the payload below it, so memory and time are O(depth * size). PostProcessing::Run then drops everything deeper than kMaxInitializeDepth anyway.
Fix: stop unpacking at the same depth PostProcessing::Run stops at. Output for inputs within the limit is unchanged: the new DeepAny test pins the depth at which post processing truncates a nested Any chain and gives the same result with and without the change. With the patch the 900 KB input is fixed in 16 ms and 188 MB.

UnpackAny unpacked google.protobuf.Any payloads all the way down. A
nested Any is parsed as a fresh message at every level, so the parser
recursion limit does not apply, and every unpacked level keeps a copy
of the payload below it. Fix, Mutate and CrossOver therefore cost
O(depth * size) memory and time on a deeply nested Any chain: a 900 KB
input took 8.3 s and 1.9 GB of RSS in Mutator::Fix.

PostProcessing::Run already drops everything deeper than
kMaxInitializeDepth, so stop unpacking at the same depth. Output for
inputs within the limit is unchanged; the same 900 KB input now takes
16 ms and 188 MB.
@google-cla

google-cla Bot commented Oct 20, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant