lattice

lux/lattice

Fork 0

mirror of https://github.com/luxfi/lattice.git synced 2026-09-24 00:25:44 +00:00

Files

T

History

zeekayandGitHub f5236f52c6 security(buffer): bound ReadUintNSlice to prevent DoS via crafted Reader (#3 )

ReadUint{16,32,64}Slice recurses on c[buffered:] without making progress
when the underlying Reader returns a partial Peek (buffered == 0) but no
error. An attacker-supplied wire prefix combined with a long destination
slice exhausts the goroutine stack on the destination chain.

Discovered by github.com/luxfi/warp/pulsar's FuzzPulseDeserialize
harness during the Mar-3 2026 PQ Consensus Architecture Freeze
(regression seed: testdata/fuzz/FuzzPulseDeserialize/ccdb090e0ca0007b).

Fix:
  - Replace recursion with an iterative loop (O(1) stack)
  - Detect zero-progress reads and return ErrZeroProgress
  - Add Read{Uint16,Uint32,Uint64}SliceBounded length-prefix-aware
    wrappers gated by MaxSliceLen() (default 1 MiB, configurable via
    LUX_LATTICE_MAX_UINT64_SLICE_LEN env var)
  - Regression tests for all three slice readers + happy path + bounded
    rejection

2026-05-29 20:31:16 -07:00

buffer.go

improved the Writer/Reader-based serialization

2023-06-12 13:52:43 +02:00

cap.go

security(buffer): bound ReadUintNSlice to prevent DoS via crafted Reader (#3 )

2026-05-29 20:31:16 -07:00

reader_test.go

security(buffer): bound ReadUintNSlice to prevent DoS via crafted Reader (#3 )

2026-05-29 20:31:16 -07:00

reader.go

security(buffer): bound ReadUintNSlice to prevent DoS via crafted Reader (#3 )