Nested lists rlp bomb fix

ethereum / ethereumj

DEPRECATED! Java implementation of the Ethereum yellowpaper. For JSON-RPC and other client features check Ethereum Harmony

GNU Lesser General Public License v3.0

2.18k stars 1.1k forks source link

Nested lists rlp bomb fix #1135

Closed zilm13 closed 6 years ago

zilm13 commented 6 years ago

Please, check

coveralls commented 6 years ago

Coverage increased (+0.1%) to 56.23% when pulling 94cce10bb92377b88c0083b3154c1ca7d3b6b407 on fix/rlp-bomb into 8680c8af3aa7cb830846f07f6a9d9b2573d1d363 on develop.

zilm13 commented 6 years ago

Here are the set of changes:

Instead of complex nested counter just throwing Exception on depth higher than 16
Some strange duplicated copy of fullTraverse removed
Added methods for RLP.decode2 with depth limit
All usages of RLP.decode2, where full decode is not really needed was modified to use decode with limited depth

mkalinin commented 6 years ago

Looks good now 👍 I'd merge it if you say that changes are well tested