You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Cmark (and Cmark-gfm) stores link reference definitions in a simple fixed-sized (16) hash map.
So lookup drops to linear time if there are many reference definitions because O(n/16) == O(n).
And it is also trivial to create malicious document which targets single bucket of the hash, making the hash completely ineffective. (See the C program generating such document below.) Such document with N reference definitions and N invalid references has O(N^2) time complexity.
Cmark
(and Cmark-gfm)stores link reference definitions in a simple fixed-sized (16) hash map.So lookup drops to linear time if there are many reference definitions because O(n/16) == O(n).
And it is also trivial to create malicious document which targets single bucket of the hash, making the hash completely ineffective. (See the C program generating such document below.) Such document with N reference definitions and N invalid references has
O(N^2)
time complexity.(Note I originally reported this to Gihub through their https://hackerone.com/github bounty program. You may find their fix here: github@66a0836)
The text was updated successfully, but these errors were encountered: