]> git.bitcoin.ninja Git - rust-lightning/commitdiff
Fix possible incomplete read bug on onion packet decode
authorValentine Wallace <vwallace@protonmail.com>
Tue, 12 Jul 2022 20:04:42 +0000 (16:04 -0400)
committerValentine Wallace <vwallace@protonmail.com>
Tue, 2 Aug 2022 23:19:39 +0000 (19:19 -0400)
Pre-existing to this PR, we were reading next packet bytes with io::Read::read,
which is not guaranteed to read all the bytes we need, only guaranteed to read
*some* bytes.

We fix this to be read_exact, which is guaranteed to read all the next hop
packet bytes.

lightning/src/ln/onion_utils.rs

index 145eb8acbaed74c3b10f8fc26bf9af608d2b7329..f81c619d7353997c1019e60ac3b967da9b6ac1b0 100644 (file)
@@ -725,7 +725,8 @@ pub(crate) fn decode_next_hop<D: DecodeInput, R: ReadableArgs<D::Arg>, N: NextPa
                                return Ok((msg, None)); // We are the final destination for this packet
                        } else {
                                let mut new_packet_bytes = N::new(hop_data.len());
-                               let read_pos = chacha_stream.read(new_packet_bytes.as_mut()).unwrap();
+                               let read_pos = hop_data.len() - chacha_stream.read.position() as usize;
+                               chacha_stream.read_exact(&mut new_packet_bytes.as_mut()[..read_pos]).unwrap();
                                #[cfg(debug_assertions)]
                                {
                                        // Check two things: