The /sdp endpoint that trusted its callers: fixing a memory-amplification DoS in py-libp2p

The py-libp2p project, which implements the libp2p peer-to-peer networking stack for Python, contains a web-based Transport called WebRTC-Direct. This allows two peers to connect directly without a certificate authority, using multiaddr hashes and DTLS handshakes. Before establishing an encrypted connection, the two peers exchange SDP offer/answer packets. Until the STUN-based listener is implemented (issue #1352), a minimal dev harness in py-libp2p handles this exchange via an HTTP server listening on the /sdp endpoint.

The vulnerability was found in the POST /sdp handler, which took the caller's Content-Length header and buffered the exact number of bytes without any upper bound. The body, headers, and decoded header values were all stored in memory, leading to a memory-amplification Denial of Service (DoS) attack. The attacker could control the size of the request body and headers, causing the memory usage to grow arbitrarily large.

The handler also lacked a timeout, enabling an attacker to continuously send header lines and never terminate the loop.

A reproduction harness was built to test the vulnerability, showing that a malicious 4 MiB request could cause the memory usage to peak at 1,113 MiB. After applying the fix, the memory usage remained minimal, even with a 1 GiB malicious request. The fix introduces three bounded constants: _MAX_SDP_BODY_SIZE (32 KiB), _MAX_HEADER_LINES (64), and _MAX_HEADER_BYTES (8 KiB) to prevent memory-amplification DoS attacks on the /sdp endpoint.