zpay32: validate UTF-8 parsing field description

zpay32/decode.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"github.com/btcsuite/btcd/btcec/v2"
 	"github.com/btcsuite/btcd/btcec/v2/ecdsa"
@@ -18,6 +19,12 @@ import (
 	"github.com/lightningnetwork/lnd/lnwire"
 )
 
+var (
+	// ErrInvalidUTF8Description is returned if the invoice description is
+	// not valid UTF-8.
+	ErrInvalidUTF8Description = errors.New("description is not valid UTF-8")
+)
+
 // DecodeOption is a type that can be used to supply functional options to the
 // Decode function.
 type DecodeOption func(*decodeOptions)
@@ -446,6 +453,10 @@ func parseDescription(data []byte) (*string, error) {
 		return nil, err
 	}
 
+	if !utf8.Valid(base256Data) {
+		return nil, ErrInvalidUTF8Description
+	}
+
 	description := string(base256Data)
 
 	return &description, nil