Skip to content

Commit 440fe8c

Browse files
morehouserustyrussell
authored andcommitted
bolt11: avoid reading uninitialized memory
If both databits and *data_len are 0, pull_uint returns unitialized stack memory in *val. Detected by valgrind and UBSan. valgrind: ==225078== Use of uninitialised value of size 8 ==225078== __sanitizer_cov_trace_cmp8 ==225078== decode_c (bolt11.c:294) ==225078== bolt11_decode_nosig (bolt11.c:881) ==225078== bolt11_decode (bolt11.c:945) UBSan: common/bolt11.c:79:29: runtime error: shift exponent 64 is too large for 64-bit type 'uint64_t'
1 parent 386d01d commit 440fe8c

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

common/bolt11.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,11 @@ static const char *pull_uint(struct hash_u5 *hu5,
7676
err = pull_bits(hu5, data, data_len, &be_val, databits, true);
7777
if (err)
7878
return err;
79-
*val = be64_to_cpu(be_val) >> (sizeof(be_val) * CHAR_BIT - databits);
79+
if (databits == 0)
80+
*val = 0;
81+
else
82+
*val = be64_to_cpu(be_val) >>
83+
(sizeof(be_val) * CHAR_BIT - databits);
8084
return NULL;
8185
}
8286

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
lnltc1zzzzzAzcQQQQQZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZXZZZZZZZZZZZZZZZZZJZZZZZZZZZZzzzZZZZZZZZ

0 commit comments

Comments
 (0)