{"action":"closed","issue":{"url":"https://api.github.com/repos/beltoforion/muparserx/issues/51","labels_url":"https://api.github.com/repos/beltoforion/muparserx/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/beltoforion/muparserx/issues/51/comments","events_url":"https://api.github.com/repos/beltoforion/muparserx/issues/51/events","html_url":"https://github.com/beltoforion/muparserx/issues/51","id":71751293,"number":51,"title":"Tolerance to malicious expressions?","user":{"login":"nasailja","id":6211073,"avatar_url":"https://avatars.githubusercontent.com/u/6211073?v=3","gravatar_id":"","url":"https://api.github.com/users/nasailja","html_url":"https://github.com/nasailja","followers_url":"https://api.github.com/users/nasailja/followers","following_url":"https://api.github.com/users/nasailja/following{/other_user}","gists_url":"https://api.github.com/users/nasailja/gists{/gist_id}","starred_url":"https://api.github.com/users/nasailja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nasailja/subscriptions","organizations_url":"https://api.github.com/users/nasailja/orgs","repos_url":"https://api.github.com/users/nasailja/repos","events_url":"https://api.github.com/users/nasailja/events{/privacy}","received_events_url":"https://api.github.com/users/nasailja/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-04-29T01:18:36Z","updated_at":"2015-06-29T20:37:04Z","closed_at":"2015-06-29T20:37:04Z","body":"How tolerant is muparserx to input from potentially malicious users, has this been investigated in any way?\r\n\r\nFor example someone could try to use up all memory by creating large matrices in expressions but this seems to require that EnableAutoCreateVar is called first. Or what about putting e.g. zeros(1000000000000) into an expression expecting a scalar, would that still create a too large matrix?\r\n\r\nHas anyone investigated how vulnerable muparserx is to expressions designed to cause e.g. buffer overruns and/or arbitrary code execution?"}}