LBRYCommunity/lbrycrd
1
0
Fork 0
Code Issues 29 Pull requests 1 Projects Releases 32 Packages Wiki Activity

fix a deserialization overflow edge case

Browse source 
A specially-constructed BlockTransactionsRequest can overflow in
deserialization in a way that is currently harmless.
This commit is contained in:
Kaz Wesley 2018-11-07 12:39:44 -08:00
parent 051faf7e9d
commit 6bed4b374d
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/blockencodings.h
View file

@ -52,12 +52,12 @@ public:
} }
} }
uint16_t offset = 0; int32_t offset = 0;
for (size_t j = 0; j < indexes.size(); j++) { for (size_t j = 0; j < indexes.size(); j++) {
if (uint64_t(indexes[j]) + uint64_t(offset) > std::numeric_limits<uint16_t>::max()) if (int32_t(indexes[j]) + offset > std::numeric_limits<uint16_t>::max())
throw std::ios_base::failure("indexes overflowed 16 bits"); throw std::ios_base::failure("indexes overflowed 16 bits");
indexes[j] = indexes[j] + offset; indexes[j] = indexes[j] + offset;
offset = indexes[j] + 1; offset = int32_t(indexes[j]) + 1;
} }
} else { } else {
for (size_t i = 0; i < indexes.size(); i++) { for (size_t i = 0; i < indexes.size(); i++) {