Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sp-trie: minor fix to avoid possible panic during node decoding #6486

Merged
merged 7 commits into from
Nov 15, 2024
Merged

sp-trie: minor fix to avoid possible panic during node decoding #6486

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
721dd2e
Fix possible panic in trie node decode
TDemeco Nov 14, 2024
34f3d40
Minor bump to `sp-trie` version
TDemeco Nov 14, 2024
1e12ba1
fmt with nightly
TDemeco Nov 14, 2024
99db422
Add prdoc
TDemeco Nov 14, 2024
59b1475
Update substrate/primitives/trie/Cargo.toml
TDemeco Nov 14, 2024
d37fc98
update Cargo.lock after reverting `sp-trie` version bump
TDemeco Nov 14, 2024
72abbb0
Merge branch 'master' into master
TDemeco Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 36 additions & 36 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 10 additions & 0 deletions prdoc/pr_6486.prdoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
title: "sp-trie: minor fix to avoid panic on badly-constructed proof"

doc:
- audience: ["Runtime Dev", "Runtime User"]
description: |
"Added a check when decoding encoded proof nodes in `sp-trie` to avoid panicking when receiving a badly constructed proof, instead erroring out."

crates:
- name: sp-trie
bump: patch
2 changes: 1 addition & 1 deletion substrate/primitives/trie/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "sp-trie"
version = "29.0.0"
version = "29.0.1"
TDemeco marked this conversation as resolved.
Show resolved Hide resolved
authors.workspace = true
description = "Patricia trie stuff using a parity-scale-codec node format"
repository.workspace = true
Expand Down
8 changes: 8 additions & 0 deletions substrate/primitives/trie/src/node_codec.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,10 @@ where
NodeHeader::Null => Ok(NodePlan::Empty),
NodeHeader::HashedValueBranch(nibble_count) | NodeHeader::Branch(_, nibble_count) => {
let padding = nibble_count % nibble_ops::NIBBLE_PER_BYTE != 0;
// data should be at least the size of the offset
if data.len() < input.offset {
return Err(Error::BadFormat)
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternative would be to do the check with let offset = input.take(1)?.start, then use offset instead of input.offset. (not exposing input.offset).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @cheme! Thanks for the feedback. I like your alternative solution but the reason I went for a simple if clause was because take increments the offset of input, so a big part of the code would have to be refactored to adapt to this which might not be worth it for a simple fix like this.

Nevertheless, I made a mistake in this PR since the correct check would be data.len() < input.offset + 1 to make sure data[input.offset] does not panic 😅 I realized after testing and this PR was sadly already merged so I'm a bit ashamed, sorry about that. I already opened another PR (#6502) that fixes this

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, would have needed a peak method (reader is implemented to be usable with scale api, iirc there another std trait that expose peak), but really not worth it.

// check that the padding is valid (if any)
if padding && nibble_ops::pad_left(data[input.offset]) != 0 {
return Err(Error::BadFormat)
Expand Down Expand Up @@ -154,6 +158,10 @@ where
},
NodeHeader::HashedValueLeaf(nibble_count) | NodeHeader::Leaf(nibble_count) => {
let padding = nibble_count % nibble_ops::NIBBLE_PER_BYTE != 0;
// data should be at least the size of the offset
if data.len() < input.offset {
return Err(Error::BadFormat)
}
// check that the padding is valid (if any)
if padding && nibble_ops::pad_left(data[input.offset]) != 0 {
return Err(Error::BadFormat)
Expand Down
Loading