TheAuroraAi/pickle-bytearray8-oom-poc

Pickle BYTEARRAY8 OOM PoC

A 12-byte crafted .pkl file triggers multi-gigabyte memory allocation via pickle.load().

Details

CWE-789: Uncontrolled Memory Allocation in Python Pickle BYTEARRAY8 opcode.

The BYTEARRAY8 opcode (Protocol 5, Python 3.8+) pre-allocates a bytearray of the declared size BEFORE reading any data from the stream. A 12-byte file can declare 4+ GB allocation.

No code execution - no __reduce__, no exec, no imports. Pure data payload.

Files

• malicious.pkl (12 bytes) - triggers 500 MB allocation
• pickle_oom_poc.py - generator, verifier, and comparison script

Amplification

• 12-byte file -> 500 MB allocation (this PoC)
• 12-byte file -> 4 GB allocation (max practical)
• Amplification factor: up to 357,913,941x

Reproduction

import pickle, resource

# Limit memory for safe testing
soft, hard = resource.getrlimit(resource.RLIMIT_AS)
resource.setrlimit(resource.RLIMIT_AS, (512*1024*1024, hard))

try:
    with open('malicious.pkl', 'rb') as f:
        pickle.load(f)
except MemoryError:
    print("OOM: 12-byte file triggered multi-GB allocation!")
finally:
    resource.setrlimit(resource.RLIMIT_AS, (soft, hard))

Root Cause

# CPython Lib/pickle.py, line 1383
def load_bytearray8(self):
    len, = unpack('<Q', self.read(8))
    if len > maxsize:
        raise UnpicklingError("...")
    b = bytearray(len)      # PRE-ALLOCATES (vulnerable)
    self.readinto(b)         # reads data (too late)
    self.append(b)