Status of Haskell Platform 2014.2.0.0
mark.lentczner at gmail.com
Tue Jul 15 22:14:37 UTC 2014
On Tue, Jul 15, 2014 at 1:59 PM, Bryan O'Sullivan <bos at serpentine.com>
> Well, it was rather late to hear that you weren't going to upgrade
> attoparsec, too ;-)
On Sun, Mar 30, 2014 at 1:06 PM, Mark Lentczner <mark.lentczner at gmail.com>
> SO, In anticipation of releasing a HP shortly (1 month?) after GHC 7.8...
> I'd like to get going on nailing down package versions.
, incLib "attoparsec" "0.10.4.0"
> In brief, an attacker can DoS a user of attoparsec by handing them a
> floating point number with a sufficiently large exponent (e.g.
> 1e1000000000). This will cause it to try to create an Integer with the
> given number of digits, thus possibly OOMing a machine or crashing a
But only if you use the Data.Atooparsec.Text parsers double, number, and
rational parser, right?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the ghc-devs