Branch: refs/heads/master
Home: https://github.com/conformal/btcwire
Commit: 5cc32bbfc7dff4a672161d4b16a2fcb82cd031fc
https://github.com/conformal/btcwire/commit/5cc32bbfc7dff4a672161d4b16a2fcb82cd031fc
Author: Dave Collins <[email protected]>
Date: 2013-10-25 (Fri, 25 Oct 2013)
Changed paths:
M common.go
M msgblock.go
M msgtx.go
Log Message:
-----------
Add bounds checking to all variable length allocs.
Several of the bitcoin data structures contain variable length entries,
many of which have well-defined maximum limits. However, there are still
a few cases, such as variable length strings and number of transactions
which don't have clearly defined maximum limits. Instead they are only
limited by the maximum size of a message.
In order to efficiently decode messages, space is pre-allocated for the
slices which hold these variable length pieces as to avoid needing to
dynamically grow the backing arrays. Due to this however, it was
previously possible to claim extremely high slice lengths which exceed
available memory (or maximum allowed slice lengths).
This commit imposes limits to all of these cases based on calculating
the maximum possible number of elements that could fit into a message
and using those as sane upper limits.
The variable length string case was found (and tests added to hit it) by
drahn@ which prompted an audit to find all cases.
