Re: Preventing Denial of Service Attack In IPC Serialization
On Jun 29, 6:20 am, Le Chaud Lapin <jaibudu...@gmail.com> wrote:
On Jun 28, 7:27 am, c...@mailvault.com wrote:
I've thought about this some also and like the term
stream constructor here. Recently I've thought that
if a derived object is being received and an error
occurs late in the process, it makes sense to attempt
to salvage what you can.
class B {...};
class I : public B {...};
class D : public I {...};
B* b = new D(stream_identifier_here);
If D's constructor releases an exception, the
standard says the sub-objects should be destructed.
Since that is how things have been set up over the
years, it can't easily be changed, but it might be
helpful if there was a way to indicate to the
compiler that a constructor is a stream constructor
and then instead of giving up, it could return an I.
The main reason I think this way is the sender,
network and receiver have put in a lot of work to
get to where it fails.
Hmm...yes, a lot of work, but don't you think it might be better to
just let the entire object go? After all, there is intuitive merit in
keeping with the spirit of automatic unwinding when full construction
failed.
I guess both could be accomodated.
B* b = new D(...);
could behave like usual and
B* b = new preserve D(...);
could return an I object if a D is not possible. That
seems better than what I wrote above as it could be
applied to more than stream constructors.
Also, the partially-received object will not have affected
the state at the sender in any way, so no harm would be lost.
The headache is you're more likely to have to request a
resend and a full resend if you throw it all away.
Finally, the context in which the serialization occurs is
indeterminate when the serialization code is written. What happens
the partial object, I, is accepted? Then what?
It does what it was designed to do. You shouldn't expect
it to do more.
I think it would be a
bit like buying an automobile might or might not come with the wheels
and windshield, and you must agree to purchase such an automobile
before you know whether it will be complete.
The I instance is useful. It has wheels and a
windshield, but no cruise control.
Might be better to have all or nothing.
You may have all you need with an I.
Brian
Ebenezer Enterprises
--
[ See http://www.gotw.ca/resources/clcm.htm for info about ]
[ comp.lang.c++.moderated. First time posters: Do this! ]