aljaz/lightning
1
0
Fork 0
mirror of https://github.com/aljazceru/lightning.git synced 2025-12-22 08:34:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

gossipd: fix thinko in node_announcement address parsing which made us miss final address

Browse Source 
'cursor < ser + max' isn't valid because we reduce 'max' as we go!  Effectively
we'll stop once we're past halfway, which can only happen with ipv6 + a torv2
address.

Ths fix is one-line, but we rename 'max' to 'len' which makes its purpose
clearer.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
Rusty Russell
2018-08-05 15:16:32 +09:30
committed by Christian Decker
parent ea6c0d4506
commit 584ee26200
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
gossipd/routing.c
View File

@@ -1228,15 +1228,16 @@ u8 *handle_channel_update(struct routing_state *rstate, const u8 *update,
static struct wireaddr *read_addresses(const tal_t *ctx, const u8 *ser) static struct wireaddr *read_addresses(const tal_t *ctx, const u8 *ser)
{ {
const u8 *cursor = ser; const u8 *cursor = ser;
size_t max = tal_count(ser); size_t len = tal_count(ser);
struct wireaddr *wireaddrs = tal_arr(ctx, struct wireaddr, 0); struct wireaddr *wireaddrs = tal_arr(ctx, struct wireaddr, 0);
int numaddrs = 0; int numaddrs = 0;
while (cursor && cursor < ser + max) {
while (cursor && len) {
struct wireaddr wireaddr; struct wireaddr wireaddr;
/* Skip any padding */ /* Skip any padding */
while (max && cursor[0] == ADDR_TYPE_PADDING) while (len && cursor[0] == ADDR_TYPE_PADDING)
fromwire_u8(&cursor, &max); fromwire_u8(&cursor, &len);
/* BOLT #7: /* BOLT #7:
* *
@@ -1245,11 +1246,13 @@ static struct wireaddr *read_addresses(const tal_t *ctx, const u8 *ser)
* - SHOULD ignore the first `address descriptor` that does * - SHOULD ignore the first `address descriptor` that does
* NOT match the types defined above. * NOT match the types defined above.
*/ */
if (!fromwire_wireaddr(&cursor, &max, &wireaddr)) { if (!fromwire_wireaddr(&cursor, &len, &wireaddr)) {
if (!cursor) if (!cursor)
/* Parsing address failed */ /* Parsing address failed */
return tal_free(wireaddrs); return tal_free(wireaddrs);
/* Unknown type, stop there. */ /* Unknown type, stop there. */
status_trace("read_addresses: unknown address type %u",
cursor[0]);
break; break;
} }