Limit buffer capacity in multiaddr visit_seq

[pawanjay176]

Buffer allocated in visit_seq does not have an upper limit. Limit buffer capacity to 4096.

[romanb]

Just to clarify, I'm not so familiar with the serialisation code: Since this is just for Vec::with_capacity, this limits only the initial capacity of the buffer, so that you cannot make the deserialisation code allocate an arbitrarily large Vec without actually "sending" that much data (e.g. if the Multiaddr is received over the network), since the Vec will still grow beyond its capacity as necessary. Correct?

[pawanjay176]

@romanb yes that is correct. Without a limit, you can send malformed input such that seq.size_hint() returns a very large value and crashes the program even if the following data is pretty small.

[mxinden]

Thanks @pawanjay176!

[mxinden]

I pushed 2e6b0ec to update patch version and changelog. Should we do a release already, or wait till the next larger release?

[romanb]

No reason to wait, a multiaddr patch release seems appropriate.

[mxinden]

For the record parity-multiaddr v0.9.5 is now released and published.