Sandstorm Cap'n Proto vulnerabilities

In Sandstorm Cap'n Proto versions before 0.4.1.1 and 0.5.x before 0.5.1.2, the totalSize method on an object reader can be exploited by remote peers to cause a denial of service through a crafted small message, leading to high CPU consumption.

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service via a list with a large number of elements.

Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application due to overflow in pointer arithmetic calculations.

An integer underflow in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before 0.5.1.1 may allow remote peers to cause a denial of service or potentially obtain sensitive information from memory or execute arbitrary code via a crafted message.

Integer overflow in layout.c++ in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before version 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.