OpenZeppelin / merkle-tree

A JavaScript library to generate merkle trees and merkle proofs.
MIT License
453 stars 109 forks source link

Add invariant validation in processMultiProof #22

Closed frangio closed 1 year ago

frangio commented 1 year ago

Related to GHSA-wprv-93r4-jj2p, although this code does not appear affected by the same issue since we don't allocate a big array at the beginning. The same bad multiproof would result in reading undefined from one of the temporary arrays, and this breaks the code regardless. This PR makes it more explicit and removes the use of non-null assertions ! which were assuming the invariant always holds.