octo
/
Zebra
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add memory DoS prevention comments

This commit is contained in:
teor 2021-03-22 07:58:47 +10:00 committed by Deirdre Connolly
parent 35fc683868
commit b623acc945
2 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
zebra-chain/src/transparent/serialize.rs
View File

@ -196,6 +196,7 @@ impl ZcashDeserialize for Input {
if len > 100 { if len > 100 {
return Err(SerializationError::Parse("coinbase has too much data")); return Err(SerializationError::Parse("coinbase has too much data"));
} }
// Memory Denial of Service: this length has just been checked
let mut data = vec![0; len as usize]; let mut data = vec![0; len as usize];
reader.read_exact(&mut data[..])?; reader.read_exact(&mut data[..])?;
let (height, data) = parse_coinbase_height(data)?; let (height, data) = parse_coinbase_height(data)?;

1
zebra-network/src/protocol/external/codec.rs vendored
View File

@ -615,6 +615,7 @@ impl Codec {
let filter_length: usize = min(body_len, MAX_FILTERADD_LENGTH); let filter_length: usize = min(body_len, MAX_FILTERADD_LENGTH);
// Memory Denial of Service: this length has just been bounded
let mut filter_bytes = vec![0; filter_length]; let mut filter_bytes = vec![0; filter_length];
reader.read_exact(&mut filter_bytes)?; reader.read_exact(&mut filter_bytes)?;