akovalenko/lnd.xprv
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

tlv: fix panic with large length

Browse Source 
This commit fixes a panic where a large length in a record could
cause the DVarBytes function to fail to allocate a byte slice.
This commit is contained in:
nsa 2019-08-15 20:03:24 -04:00 committed by Conner Fromknecht
parent c4ba5577cc
commit dfd1b38648
No known key found for this signature in database
GPG Key ID: E7D737B67FA592C7
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
tlv/stream.go
View File

@ -6,12 +6,18 @@ import (
"io"
"io/ioutil"
"math"
"github.com/lightningnetwork/lnd/lnwire"
)
// ErrStreamNotCanonical signals that a decoded stream does not contain records
// sorting by monotonically-increasing type.
var ErrStreamNotCanonical = errors.New("tlv stream is not canonical")
// ErrRecordTooLarge signals that a decoded record has a length that is too
// long to parse.
var ErrRecordTooLarge = errors.New("record is too large")
// ErrUnknownRequiredType is an error returned when decoding an unknown and even
// type from a Stream.
type ErrUnknownRequiredType Type
@ -183,6 +189,10 @@ func (s *Stream) Decode(r io.Reader) error {
return err
}
if length > lnwire.MaxMessagePayload {
return ErrRecordTooLarge
}
// Search the records known to the stream for this type. We'll
// begin the search and recordIdx and walk forward until we find
// it or the next record's type is larger.