Headline
CVE-2022-2584: fix: use protowire for Links bytes decoding · ipld/go-codec-dagpb@a17ace3
The dag-pb codec can panic when decoding invalid blocks.
@@ -32,6 +32,7 @@ type testCase struct { expectedForm string encodeError string decodeError string testEncode bool }
var testCases = []testCase{ @@ -64,6 +65,13 @@ var testCases = []testCase{ }`, encodeError: "missing required fields: Links", }, { name: "Data some, short", node: &pbNode{data: dataSome}, expectedBytes: "0a0500010203", decodeError: "unexpected EOF", encodeError: "missing required fields: Links", }, { name: "Links zero", node: &pbNode{links: []pbLink{}}, @@ -113,6 +121,12 @@ var testCases = []testCase{ }`, }, { name: "Links Hash some, short", node: &pbNode{links: []pbLink{{hash: acid}}}, expectedBytes: "120b0a090155000500010203", decodeError: "unexpected EOF", testEncode: false, }, { name: "Links Name zero", node: &pbNode{links: []pbLink{{name: zeroName, hasName: true}}}, expectedBytes: "12021200", @@ -211,24 +225,26 @@ func verifyRoundTrip(t *testing.T, tc testCase) { node := buildNode(*tc.node) actualBytes, err = nodeToString(t, node)
if tc.encodeError != “” { if err != nil { if !strings.Contains(err.Error(), tc.encodeError) { t.Fatalf("got unexpeced encode error: [%v] (expected [%v])", err.Error(), tc.encodeError) if tc.testEncode { if tc.encodeError != “” { if err != nil { if !strings.Contains(err.Error(), tc.encodeError) { t.Fatalf("got unexpeced encode error: [%v] (expected [%v])", err.Error(), tc.encodeError) } } else { t.Fatalf("did not get expected encode error: %v", tc.encodeError) } } else { t.Fatalf("did not get expected encode error: %v", tc.encodeError) } } else { if err != nil { t.Fatal(err) } else { if actualBytes != tc.expectedBytes { t.Logf( "Expected bytes: [%v]\nGot: [%v]\n", tc.expectedBytes, actualBytes) t.Error(“Did not match”) if err != nil { t.Fatal(err) } else { if actualBytes != tc.expectedBytes { t.Logf( "Expected bytes: [%v]\nGot: [%v]\n", tc.expectedBytes, actualBytes) t.Error(“Did not match”) } } } }
Related news
go-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.5.0.