---
tags:
  - security
  - proof-of-concept
  - protobuf
license: mit
---

# Protocol Buffers LogDescriptor labels materialization DoS PoC

This repository contains a benign security research PoC for a protobuf binary
artifact that drives large repeated-message materialization during
`google.api.log_pb2.LogDescriptor.ParseFromString(...)`.

Files:

- `control_one_description.pb`
- `malicious_labels_5000000.pb`
- `reproduce.py`

Observed behavior:

- control artifact:
  - parses successfully with zero `labels`
  - `description_len = 9999995`
- malicious artifact:
  - both files are `10,000,000` bytes
  - parses successfully with `5,000,000` `labels` entries
  - increases peak RSS by about `330336 kB` in local clean-process replay
  - increases peak RSS by `330272 kB` in unauthenticated public replay

Tested runtime:

- `protobuf==7.35.1`
- Python: `/usr/bin/python3`

Public files:

- `https://huggingface.co/hacnho/protobuf-logdescriptor-labels-dos-poc/resolve/main/control_one_description.pb`
- `https://huggingface.co/hacnho/protobuf-logdescriptor-labels-dos-poc/resolve/main/malicious_labels_5000000.pb`
- `https://huggingface.co/hacnho/protobuf-logdescriptor-labels-dos-poc/resolve/main/reproduce.py`
- repo sha: `09ee2bd4827f4cea75e28d4b430edda43b4bc3c0`

Reproduction:

```bash
python3 reproduce.py
```