[SECURITY] Request: Add recursion depth limit to KlvDecoder #6934

Security Request: Recursion Depth Limit in KlvDecoder

Requested By: Alliance project (codice/alliance)
Issue: Uncontrolled recursion in KlvDecoder allows stack overflow DoS attacks
CVSS: 7.5 (High)
Alliance Tracking: montge/alliance#53

Problem

DDF's KlvDecoder.decode() recursively processes nested KlvLocalSet structures without depth limits. This enables Denial of Service attacks via deeply nested KLV structures.

Attack Scenario:

Malicious MPEG-TS stream with 5,000-10,000 nested KLV Local Sets
→ KlvDecoder.decode() recursively processes each level
→ Stack overflow after ~1,000-5,000 levels (platform dependent)
→ JVM crash → DoS

Affected Code:

• org.codice.ddf.libs.klv.KlvDecoder.decode()
• Used by: Alliance STANAG 4609 FMV processing, DDF metadata extraction

Proposed Fix

Add maximum recursion depth parameter to KlvDecoder:

public class KlvDecoder {
    private static final int MAX_RECURSION_DEPTH = 32;
    
    public KlvContext decode(byte[] data) throws KlvDecodingException {
        return decode(data, 0);
    }
    
    private KlvContext decode(byte[] data, int depth) throws KlvDecodingException {
        if (depth > MAX_RECURSION_DEPTH) {
            throw new KlvDecodingException(
                "KLV nesting depth exceeds maximum: " + depth);
        }
        
        // ... existing decode logic ...
        // For nested Local Sets, call: decode(nestedData, depth + 1)
    }
}

Alliance Interim Mitigation

Alliance has implemented best-effort pre-validation in KlvSecurityValidator that scans KLV structure before decoding. This provides partial protection but cannot catch all nesting patterns without fully duplicating KlvDecoder logic.

Commit: montge/alliance@b26e0f6c

Benefits

✅ Prevents stack overflow DoS attacks
✅ Graceful failure with clear error message
✅ Minimal performance impact (depth counter is cheap)
✅ Backward compatible (legitimate KLV rarely exceeds 5-10 levels)
✅ Protects all DDF-based applications

Request

Could the DDF team:

1. Review this security concern
2. Consider adding recursion depth limit to KlvDecoder
3. Provide timeline for potential fix

We're happy to contribute a pull request if helpful.

Thank you for maintaining DDF!

Contact: Alliance security team via montge/alliance repository
References:

• Alliance Issue: [SECURITY] CUSTOM-KLV-003: Uncontrolled Recursion in Nested KLV (CVSS 7.5) montge/alliance#53
• Alliance Fix: montge/alliance@b26e0f6c
• Phase 3C Tracking: [Tracking] Phase 3C Security Remediation - Current Status montge/alliance#50