Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add potential fix for OOR access on Vector #54

Merged
merged 15 commits into from
Jun 5, 2023

Conversation

0xTylerHolmes
Copy link
Contributor

Unlike the issue this does not use the safe vec::get method, but does emit an already defined DeserializeError. I am open to other options for the easiest way to fix this. If this is a desired approach I can add some other guards where they are needed.

@0xTylerHolmes
Copy link
Contributor Author

Note this is in reference to #22

@0xTylerHolmes
Copy link
Contributor Author

In reference to #22 I changed it to instead use the .get() method on encoding. To my knowledge there isn't a good way to get the exact reason of the failure so I just added a generic DeserializeError::InvalidRange{range: Range, buffer_length: usize},

Copy link
Owner

@ralexstokes ralexstokes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice! let's unpack the code a bit and I think DeserializeError::ExpectedFurtherInput makes more sense here -- what do you think?

ssz-rs-derive/src/lib.rs Outdated Show resolved Hide resolved
ssz-rs-derive/src/lib.rs Outdated Show resolved Hide resolved
ssz-rs/src/de.rs Outdated Show resolved Hide resolved
@doubledup doubledup mentioned this pull request Jun 1, 2023
@ralexstokes ralexstokes merged commit 069dfd5 into ralexstokes:main Jun 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants