]> git.bitcoin.ninja Git - rust-lightning/commitdiff
Fix OOM crash in ChannelMonitor::deserialize found by AFL 2018-07-chanmon-oom
authorMatt Corallo <git@bluematt.me>
Mon, 23 Jul 2018 18:53:34 +0000 (14:53 -0400)
committerMatt Corallo <git@bluematt.me>
Mon, 23 Jul 2018 19:01:25 +0000 (15:01 -0400)
src/ln/channelmonitor.rs

index 2ee5b37a3fb787b2ff51158287296d54fea54066..3fb1d8ad836e590dd54c6c5f09e34f9c767fdea9 100644 (file)
@@ -743,7 +743,7 @@ impl ChannelMonitor {
                for _ in 0..remote_claimable_outpoints_len {
                        let txid = Sha256dHash::from(read_bytes!(32));
                        let outputs_count = byte_utils::slice_to_be64(read_bytes!(8));
-                       if outputs_count > data.len() as u64 * 32 { return None; }
+                       if outputs_count > data.len() as u64 / 32 { return None; }
                        let mut outputs = Vec::with_capacity(outputs_count as usize);
                        for _ in 0..outputs_count {
                                outputs.push(read_htlc_in_commitment!());