From 345590f27f81517fd7b560a3fafb0a2c8b498094 Mon Sep 17 00:00:00 2001 From: Felix Lange Date: Sat, 18 Jul 2015 16:13:20 +0200 Subject: rlp: fix check for canonical byte array size Decoding did not reject byte arrays of length one with a single element b where 55 < b < 128. Such byte arrays must be rejected because they must be encoded as the single byte b instead. --- rlp/decode.go | 6 +++--- rlp/decode_test.go | 19 +++++++++++++------ 2 files changed, 16 insertions(+), 9 deletions(-) (limited to 'rlp') diff --git a/rlp/decode.go b/rlp/decode.go index f17690522..cc402fc94 100644 --- a/rlp/decode.go +++ b/rlp/decode.go @@ -361,7 +361,7 @@ func decodeByteArray(s *Stream, val reflect.Value) error { return err } // Reject cases where single byte encoding should have been used. - if size == 1 && slice[0] < 56 { + if size == 1 && slice[0] < 128 { return wrapStreamError(ErrCanonSize, val.Type()) } case List: @@ -623,7 +623,7 @@ func (s *Stream) Bytes() ([]byte, error) { if err = s.readFull(b); err != nil { return nil, err } - if size == 1 && b[0] < 56 { + if size == 1 && b[0] < 128 { return nil, ErrCanonSize } return b, nil @@ -687,7 +687,7 @@ func (s *Stream) uint(maxbits int) (uint64, error) { return 0, ErrCanonInt case err != nil: return 0, err - case size > 0 && v < 56: + case size > 0 && v < 128: return 0, ErrCanonSize default: return v, nil diff --git a/rlp/decode_test.go b/rlp/decode_test.go index 71dacaba4..6f90d6e1d 100644 --- a/rlp/decode_test.go +++ b/rlp/decode_test.go @@ -113,12 +113,16 @@ func TestStreamErrors(t *testing.T) { {"00", calls{"Uint"}, nil, ErrCanonInt}, {"820002", calls{"Uint"}, nil, ErrCanonInt}, {"8133", calls{"Uint"}, nil, ErrCanonSize}, - {"8156", calls{"Uint"}, nil, nil}, + {"817F", calls{"Uint"}, nil, ErrCanonSize}, + {"8180", calls{"Uint"}, nil, nil}, // Size tags must use the smallest possible encoding. // Leading zero bytes in the size tag are also rejected. {"8100", calls{"Uint"}, nil, ErrCanonSize}, {"8100", calls{"Bytes"}, nil, ErrCanonSize}, + {"8101", calls{"Bytes"}, nil, ErrCanonSize}, + {"817F", calls{"Bytes"}, nil, ErrCanonSize}, + {"8180", calls{"Bytes"}, nil, nil}, {"B800", calls{"Kind"}, withoutInputLimit, ErrCanonSize}, {"B90000", calls{"Kind"}, withoutInputLimit, ErrCanonSize}, {"B90055", calls{"Kind"}, withoutInputLimit, ErrCanonSize}, @@ -132,11 +136,11 @@ func TestStreamErrors(t *testing.T) { {"", calls{"Kind"}, nil, io.EOF}, {"", calls{"Uint"}, nil, io.EOF}, {"", calls{"List"}, nil, io.EOF}, - {"8158", calls{"Uint", "Uint"}, nil, io.EOF}, + {"8180", calls{"Uint", "Uint"}, nil, io.EOF}, {"C0", calls{"List", "ListEnd", "List"}, nil, io.EOF}, {"", calls{"List"}, withoutInputLimit, io.EOF}, - {"8158", calls{"Uint", "Uint"}, withoutInputLimit, io.EOF}, + {"8180", calls{"Uint", "Uint"}, withoutInputLimit, io.EOF}, {"C0", calls{"List", "ListEnd", "List"}, withoutInputLimit, io.EOF}, // Input limit errors. @@ -153,11 +157,11 @@ func TestStreamErrors(t *testing.T) { // down toward zero in Stream.remaining, reading too far can overflow // remaining to a large value, effectively disabling the limit. {"C40102030401", calls{"Raw", "Uint"}, withCustomInputLimit(5), io.EOF}, - {"C4010203048158", calls{"Raw", "Uint"}, withCustomInputLimit(6), ErrValueTooLarge}, + {"C4010203048180", calls{"Raw", "Uint"}, withCustomInputLimit(6), ErrValueTooLarge}, // Check that the same calls are fine without a limit. {"C40102030401", calls{"Raw", "Uint"}, withoutInputLimit, nil}, - {"C4010203048158", calls{"Raw", "Uint"}, withoutInputLimit, nil}, + {"C4010203048180", calls{"Raw", "Uint"}, withoutInputLimit, nil}, // Unexpected EOF. This only happens when there is // no input limit, so the reader needs to be 'dumbed down'. @@ -349,6 +353,7 @@ var decodeTests = []decodeTest{ // byte arrays {input: "02", ptr: new([1]byte), value: [1]byte{2}}, + {input: "8180", ptr: new([1]byte), value: [1]byte{128}}, {input: "850102030405", ptr: new([5]byte), value: [5]byte{1, 2, 3, 4, 5}}, // byte array errors @@ -359,6 +364,7 @@ var decodeTests = []decodeTest{ {input: "C3010203", ptr: new([5]byte), error: "rlp: expected input string or byte for [5]uint8"}, {input: "86010203040506", ptr: new([5]byte), error: "rlp: input string too long for [5]uint8"}, {input: "8105", ptr: new([1]byte), error: "rlp: non-canonical size information for [1]uint8"}, + {input: "817F", ptr: new([1]byte), error: "rlp: non-canonical size information for [1]uint8"}, // zero sized byte arrays {input: "80", ptr: new([0]byte), value: [0]byte{}}, @@ -427,7 +433,8 @@ var decodeTests = []decodeTest{ {input: "80", ptr: new(*uint), value: uintp(0)}, {input: "C0", ptr: new(*uint), error: "rlp: expected input string or byte for uint"}, {input: "07", ptr: new(*uint), value: uintp(7)}, - {input: "8158", ptr: new(*uint), value: uintp(0x58)}, + {input: "817F", ptr: new(*uint), error: "rlp: non-canonical size information for uint"}, + {input: "8180", ptr: new(*uint), value: uintp(0x80)}, {input: "C109", ptr: new(*[]uint), value: &[]uint{9}}, {input: "C58403030303", ptr: new(*[][]byte), value: &[][]byte{{3, 3, 3, 3}}}, -- cgit v1.2.3