Description
I found two ways to DoS a PySyncObj server by naive fuzzing aka cat /dev/urandom >/dev/tcp/localhost/5010
First: If attackers has sufficient bandwidth, they can just send infinite stream of data. This causes __tryReadBuffer() to loop forever, saving everything in memory until it runs out.
Second: If attackers does not have sufficient bandwidth, they can still send message with length 0x7FFFFFFF and 2GiB of garbage. This again allows filling 2GiB of available memory per one attacker connection.
I fix it on my servers like this: https://github.com/Sandwichs-del/PySyncObj/tree/Sandwichs-del-patch-3-fix-unauthenticated-DoS, feel free to pull if you think changing __tryReadBuffer like that is acceptable.
But even with these holes plugged I am starting to feel it will never be as good as TLS (#46).