Protect against OOB offset in variable list SSZ decoding (#974)

* Add "pretty-ssz" tool to lcli

* Protect against OOB SSZ offset

* Add more work on decoding

* Fix benches

* Add more decode fixes

* Rename fixed_ptr

* Add, fix tests

* Add extra test

* Increase SSZ decode error granularity

* Ripples new error types across ssz crate

* Add comment to `sanitize_offset`

* Introduce max_len to SSZ list decoding

* Restrict FixedVector, check for zero-len items

* Double check for empty list

* Address Michael's comment
This commit is contained in:
Paul Hauner
2020-04-20 15:35:47 +10:00
committed by GitHub
parent 32074f0d09
commit b374ead24b
8 changed files with 263 additions and 82 deletions

View File

@@ -152,7 +152,7 @@ mod round_trip {
assert_eq!(
VariableLen::from_ssz_bytes(&bytes),
Err(DecodeError::OutOfBoundsByte { i: 9 })
Err(DecodeError::OffsetIntoFixedPortion(9))
);
}
@@ -182,7 +182,7 @@ mod round_trip {
assert_eq!(
VariableLen::from_ssz_bytes(&bytes),
Err(DecodeError::OutOfBoundsByte { i: 11 })
Err(DecodeError::OffsetSkipsVariableBytes(11))
);
}
@@ -284,7 +284,7 @@ mod round_trip {
assert_eq!(
ThreeVariableLen::from_ssz_bytes(&bytes),
Err(DecodeError::OutOfBoundsByte { i: 14 })
Err(DecodeError::OffsetsAreDecreasing(14))
);
}