Deserialization fixes #735
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
Signed-off-by: ljedrz <[email protected]>
howardwu
reviewed
Apr 3, 2022
|
Thanks for catching these Lukasz! Looks like we should redesign our serialization infrastructure to account for this. |
|
Alright, this should handle the serialization cases that were caught. |
howardwu
approved these changes
Apr 3, 2022
|
I can confirm that the fuzzing artifacts still pass with the additional changes 👍; I'll run the tests a bit more tomorrow just to be safe. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
While running fuzz tests for the snarkOS network layer, I detected a few deserialization-related vulnerabilities that needed to be patched; I planned to finalize them and release the results on Monday, but seeing the extra weekend changes, I decided to be proactive about it and provide the results I have already.
Most of these are either overallocations or unwraps, which will cause a crash when deserializing broken/malicious network messages.
Feel free to adjust the numbers I used, depending on the expected maximum values. I initially thought using
Vec::try_reserveor tweaking the allocator would be preferable, but in the end I believe we should instead be imposing limits on a per-case basis.Supersedes https://github.com/AleoHQ/snarkVM/pull/592 and https://github.com/AleoHQ/snarkVM/pull/609.