search

nbd-wtf / go-nostr

Nostr library for Golang
MIT License
364 stars 102 forks source link

nip44: panic caused by uint16 overflow #134

Closed sebdeveloper6952 closed 3 months ago

sebdeveloper6952 commented 3 months ago

unpaddedLen is a uint16: https://github.com/nbd-wtf/go-nostr/blob/3ea28878de02eca25ed4329a0238c65f002a119f/nip44/nip44.go#L105

if unpaddedLen holds the value 65535, adding 2 results in an overflow and a panic in line 143: https://github.com/nbd-wtf/go-nostr/blob/3ea28878de02eca25ed4329a0238c65f002a119f/nip44/nip44.go#L143

panic: runtime error: slice bounds out of range [2:1]

goroutine 1 [running]:
github.com/nbd-wtf/go-nostr/nip44.Decrypt({0x140003a8000?, 0x14000390000?}, {0x14000026180, 0x20, 0x20})
    /Users/sebdev/Documents/sebas/projects/nostr/go-nostr/nip44/nip44.go:143 +0x5d4

Failing test case provided in my fork: https://github.com/sebdeveloper6952/go-nostr/blob/de50e524b7d7e41901b9ac07e9dda991166e3030/nip44/nip44_test.go#L227