Re: [Cellar] FW: New Version Notification - draft-ietf-cellar-ffv1-18.txt

[Spencer Dawkins at IETF <[e-mail]>]

Hi, Roman,

On Wed, Oct 21, 2020 at 12:38 PM Roman Danyliw <[e-mail]> wrote:

> Hi!
> (I can't find your response email to my ballot in my mail client despite
> it being in the archive, so apologizes for making the new thread).
>
> Thanks for the -18 which cleared most of the COMMENTs.  I updated my
> ballot.
>
> In the spirit of clearing what I consider a straightforward DISCUSS, might
> I suggest:
>
> OLD
>
>   Implementations of the FFV1 codec need to take appropriate security
>    considerations into account, as outlined in [RFC4732].  It is
>    extremely important for the decoder to be robust against malicious
>    payloads.  Malicious payloads MUST NOT cause the decoder to overrun
>    its allocated memory or to take an excessive amount of resources to
>    decode.  The same applies to the encoder, ...
>
> NEW
>
> Implementations of the FFV1 codec need to take appropriate security
> considerations into account.  Those related to denial of service are
> outlined in Section 2.1 of [RFC4732].  It is extremely important for the
> decoder to be robust against malicious payloads.  Malicious payloads MUST
> NOT cause the decoder to overrun its allocated memory or to take an
> excessive amount of resources to decode.    An overrun in allocated memory
> could lead to arbitrary code execution by an attacker.  The same applies to
> the encoder, ...
>
> Regards,
> Roman
>

Thanks for this! and I am including the working group in my reply, so
everyone will see it.

Best,

Spencer


>
> -----Original Message-----
> From: [e-mail] <[e-mail]>
> Sent: Wednesday, October 7, 2020 12:52 PM
> To: Michael Richardson <[e-mail]>; [e-mail];
> [e-mail]; Roman Danyliw <[e-mail]>; Peter B. <
> [e-mail]>
> Subject: New Version Notification - draft-ietf-cellar-ffv1-18.txt
>
>
> A new version (-18) has been submitted for draft-ietf-cellar-ffv1:
> https://www.ietf.org/id/draft-ietf-cellar-ffv1-18.txt
> https://www.ietf.org/id/draft-ietf-cellar-ffv1-18.html
>
>
> The IETF datatracker page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-cellar-ffv1/
>
> Diff from previous version:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-cellar-ffv1-18
>
> Please note that it may take a couple of minutes from the time of
> submission until the diff is available at tools.ietf.org.
>
> IETF Secretariat.
>
>
>