From: Valentine Wallace <vwallace@protonmail.com>
Date: Tue, 12 Jul 2022 20:04:42 +0000 (-0400)
Subject: Fix possible incomplete read bug on onion packet decode
X-Git-Tag: v0.0.111~46^2
X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=commitdiff_plain;h=17ec697f8f09d608f6a3d2703ed4f4409773b4bf;p=rust-lightning

Fix possible incomplete read bug on onion packet decode

Pre-existing to this PR, we were reading next packet bytes with io::Read::read,
which is not guaranteed to read all the bytes we need, only guaranteed to read
*some* bytes.

We fix this to be read_exact, which is guaranteed to read all the next hop
packet bytes.
---

diff --git a/lightning/src/ln/onion_utils.rs b/lightning/src/ln/onion_utils.rs
index 145eb8acb..f81c619d7 100644
--- a/lightning/src/ln/onion_utils.rs
+++ b/lightning/src/ln/onion_utils.rs
@@ -725,7 +725,8 @@ pub(crate) fn decode_next_hop<D: DecodeInput, R: ReadableArgs<D::Arg>, N: NextPa
 				return Ok((msg, None)); // We are the final destination for this packet
 			} else {
 				let mut new_packet_bytes = N::new(hop_data.len());
-				let read_pos = chacha_stream.read(new_packet_bytes.as_mut()).unwrap();
+				let read_pos = hop_data.len() - chacha_stream.read.position() as usize;
+				chacha_stream.read_exact(&mut new_packet_bytes.as_mut()[..read_pos]).unwrap();
 				#[cfg(debug_assertions)]
 				{
 					// Check two things: