Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So, how much memory would a real-world parser actually consume given this file? I'd try it, but I had to RMA my workstation's motherboard yesterday, leaving me with a machine that only has 3GB, which is the obvious minimum for a full expansion. But I could imagine an XML parser might use UCS-2 internally, inflating this to 6GB. Or, some parsers might be clever and not attempt a full expansion.


So you're asking how much memory this resoource exhaustion attack consumes when you run it.

Each line in the WP examaple amplifies by a factor of 10. It has 9 lines. It's 10e9. That's a billion times 3, which is just enough to 32-bit virtual memory space in common operating systems.

Of course the XML implementation could be smart and short-circuit this while preserving the semantics.


I think you mean 10^9 = 1e9 rather than 10e9.

(And the parent actually mentioned the 3 GB minimum, I think it was essentially asking how much extra memory a real world XML parser uses.)


Nope, 10e8 is what you're both looking for, as 1^9 is.. 1.


Actually, dbaupp is correct. The e1 parts means *10^9.

See: https://www.wolframalpha.com/input/?i=1e9


Nope, 1e9 = 1 * 10^9. He was fine.


You could try using an iteration that only required 300 MB for a full expansion...




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: