highperfocused/lnd
1
0
Fork 0
mirror of https://github.com/lightningnetwork/lnd.git synced 2025-10-03 20:14:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

tlv/truncated: fix decoding bug in DTUint16 and DTUint32

Browse Source 
This commit fixes a bug in DTUint16 and DTUint32, which would cause them
to read too many bytes from the reader. This is due to the fact that
ReadFull was being called on a slice that could be greater than the
underlying type. This is not an issue for DTUint64, since the 8-byte
buffer corresponds to the maximum possible size of a uint64. The
solution is to clamp the buffer to 2 and 4 bytes respectively.

A series of tests are also added to exercise these cases.
This commit is contained in:
Conner Fromknecht
2019-08-07 18:51:52 -07:00
parent 32bb9917f9
commit e6fdfbb1cb
2 changed files with 166 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tlv/truncated.go
View File

@@ -44,7 +44,7 @@ func ETUint16(w io.Writer, val interface{}, buf *[8]byte) error {
// be resurrected. An error is returned if val is not a *uint16.
func DTUint16(r io.Reader, val interface{}, buf *[8]byte, l uint64) error {
if t, ok := val.(*uint16); ok && l <= 2 {
_, err := io.ReadFull(r, buf[2-l:])
_, err := io.ReadFull(r, buf[2-l:2])
if err != nil {
return err
}
@@ -96,7 +96,7 @@ func ETUint32(w io.Writer, val interface{}, buf *[8]byte) error {
// be resurrected. An error is returned if val is not a *uint32.
func DTUint32(r io.Reader, val interface{}, buf *[8]byte, l uint64) error {
if t, ok := val.(*uint32); ok && l <= 4 {
_, err := io.ReadFull(r, buf[4-l:])
_, err := io.ReadFull(r, buf[4-l:4])
if err != nil {
return err
}