lnwire: ensure that addrs in ClosedSigned are below 35 bytes

This is a very simple bug that go-fuzz found. If length of an address
within CloseSigned is greater than 34, a runtime error: slice bounds out
of range happens. An error should be returned instead.
This commit is contained in:
nsa 2017-09-01 08:26:57 -04:00 committed by Olaoluwa Osuntokun
parent 8ef2263e46
commit d97575d6d2

@ -587,6 +587,9 @@ func readElement(r io.Reader, element interface{}) error {
length := binary.BigEndian.Uint16(addrLen[:]) length := binary.BigEndian.Uint16(addrLen[:])
var addrBytes [34]byte var addrBytes [34]byte
if length > 34 {
return fmt.Errorf("Cannot read %d bytes into addrBytes", length)
}
if _, err = io.ReadFull(r, addrBytes[:length]); err != nil { if _, err = io.ReadFull(r, addrBytes[:length]); err != nil {
return err return err
} }