Skip to content

OOB access in AttributionData::verify #3708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
TheBlueMatt opened this issue Apr 4, 2025 · 0 comments · Fixed by #3709
Closed

OOB access in AttributionData::verify #3708

TheBlueMatt opened this issue Apr 4, 2025 · 0 comments · Fixed by #3709
Assignees
@joostjager
Milestone
0.2

Comments

@TheBlueMatt
Copy link
Collaborator

The process_onion_failure fuzzer found the following OOB access in the new attributable failures code:

thread '<unnamed>' panicked at 'range end index 116 out of range for slice of length 80', library/core/src/slice/index.rs:73:5
stack backtrace:
   0: rust_begin_unwind
             at /usr/src/rustc-1.63.0/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /usr/src/rustc-1.63.0/library/core/src/panicking.rs:142:14
   2: core::slice::index::slice_end_index_len_fail_rt
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:73:5
   3: core::ops::function::FnOnce::call_once
             at /usr/src/rustc-1.63.0/library/core/src/ops/function.rs:248:5
   4: core::intrinsics::const_eval_select
             at /usr/src/rustc-1.63.0/library/core/src/intrinsics.rs:2376:5
   5: core::slice::index::slice_end_index_len_fail
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:67:9
   6: <core::ops::range::Range<usize> as core::slice::index::SliceIndex<[T]>>::index
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:304:13
   7: <core::ops::range::RangeTo<usize> as core::slice::index::SliceIndex<[T]>>::index
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:351:9
   8: core::slice::index::<impl core::ops::index::Index<I> for [T]>::index
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:18:9
   9: core::array::<impl core::ops::index::Index<I> for [T; N]>::index
             at /usr/src/rustc-1.63.0/library/core/src/array/mod.rs:286:9
  10: lightning::ln::onion_utils::AttributionData::verify
             at /root/rust-lightning/lightning/src/ln/onion_utils.rs:2325:15
  11: lightning::ln::onion_utils::process_onion_failure_inner
             at /root/rust-lightning/lightning/src/ln/onion_utils.rs:1223:21
  12: lightning::ln::onion_utils::process_onion_failure
             at /root/rust-lightning/lightning/src/ln/onion_utils.rs:1026:3
  13: lightning_fuzz::process_onion_failure::do_test
             at ./src/process_onion_failure.rs:132:2
  14: lightning_fuzz::process_onion_failure::process_onion_failure_test
             at ./src/process_onion_failure.rs:137:2
  15: process_onion_failure_target::run_test_cases::{{closure}}::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:92:7
  16: std::panicking::try::do_call
             at /usr/src/rustc-1.63.0/library/std/src/panicking.rs:492:40
  17: std::panicking::try
             at /usr/src/rustc-1.63.0/library/std/src/panicking.rs:456:19
  18: std::panic::catch_unwind
             at /usr/src/rustc-1.63.0/library/std/src/panic.rs:137:14
  19: process_onion_failure_target::run_test_cases::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:91:19
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

# xxd -p test_cases/process_onion_failure/SIGABRT.PC.7ffff7e45e3c.STACK.d64ce0d4f.CODE.-6.ADDR.0.INSTR.mov____%eax,%ebp.fuzz
1d000021000000000005102914e176baef5df3605165fce1af58fb2da98e
58b8cb2a678131fbceb9bb2de6c4e6b62a001c42c3efd998045e2c1610f4
621fdc073ba895059619673c990171b0bfefef9ba1cac639e4b675c905a5
ef093f817b46eb84c42f29fb3634a25b6622fce2a2dbc7b8bf7bf533a4f0
543521034b63c7110368a23afab210f2129b00d4b5c75c7559669160cff0
481ea5f6ef1d6ccd1964036a07c076c994620c7f15ac1bfed581ffc924d0
effb82663b1507cbd2a999c067ab8ffc55e38e78e0506c5c65043cefb441
ff59d3404549d82c96c89e30318615c27e550e7bbb828dcc923e651d0000
000000010000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000007a080000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000d34d00
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000ff
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000010400000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000ff00000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000018fcffffffffffff00000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000ffffff00feba0e03000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000009a0000000104
00000000000200000000000000000000000000839f0000ff010004000000
0040000000000000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@joostjager joostjager

Labels
None yet
Projects
None yet
Milestone
0.2
Development

Successfully merging a pull request may close this issue.

Fix long route failure attribution joostjager/rust-lightning
2 participants
@TheBlueMatt @joostjager