diwakergupta / stacks-blockchain-tob-audit

GNU General Public License v3.0
0 stars 0 forks source link

Out-of-memory errors in `Value::consensus_deserialize` #7

Open smoelius opened 4 years ago

smoelius commented 4 years ago

The errors occur on these lines: https://github.com/trailofbits/x-audit-blockstack-core/blob/e2d3d5bae539d242851620e28129af6c4a9de642/src/vm/types/serialization.rs#L323 https://github.com/trailofbits/x-audit-blockstack-core/blob/e2d3d5bae539d242851620e28129af6c4a9de642/src/vm/types/serialization.rs#L353 A witnessing example for the former is:

[11, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255]

Recommend that a reasonable bound be imposed upon len, and that an error be returned when that bound is exceeded.