Fix LEB128-related panic again (#2337)

* Fix LEB128-related panic again * Update CHANGELOG * Rustfmt
paritytech · Jun 7, 2022 · f2748c2 · f2748c2
1 parent 96bd6d1
commit f2748c2
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/bin/wasm-node/CHANGELOG.md b/bin/wasm-node/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixed
 
+- Fix another panic in case of a carefully-crafted LEB128 length. ([#2337](https://github.com/paritytech/smoldot/pull/2337))
 - Fix a panic when decoding a block header containing a large number of Aura authorities. ([#2338](https://github.com/paritytech/smoldot/pull/2338))
 - Fix multiple panics when decoding network messages in case where these messages were truncated. ([#2340](https://github.com/paritytech/smoldot/pull/2340))
 

diff --git a/src/util/leb128.rs b/src/util/leb128.rs
@@ -166,6 +166,10 @@ impl FramedInProgress {
             let mut out = 0usize;
 
             for (n, byte) in buffer.iter().enumerate() {
+                if (7 * n) >= usize::try_from(usize::BITS).unwrap() {
+                    return Some(Err(FramedError::LengthPrefixTooLarge));
+                }
+
                 match usize::from(*byte & 0b111_1111).checked_mul(1 << (7 * n)) {
                     Some(o) => out |= o,
                     None => return Some(Err(FramedError::LengthPrefixTooLarge)),