Found by: 3a (anti-DPI) whole-branch review (PR #43).
Membership::tick_digest builds a GossipMsg::Digest from the entire directory with no per-datagram cap (only the u16 entry count is bounded). At NodeId(16)+seq(8)=24 bytes/entry, a directory of ≥~2731 reachable members produces a body >65535 bytes. Under obfuscation (obf_psk set), yip_obf::obfuscate does u16::try_from(body.len()).expect("body fits u16") → panic.
In the obf-off path the same oversized datagram degrades gracefully (a sendto EMSGSIZE, dropped). So 3a converts a silent degrade into a crash.
Notes:
- Large-mesh-only. The single-datagram full-directory digest is itself unshippable past ~2700 members regardless of obfuscation (>MTU → gossip can't converge), so the mesh is already non-functional at that size.
- Not attacker-controlled (requires that many CA-certified members), so low severity — but a daemon panic is worse than a drop.
Fix options:
- Chunk/bound the
Digest per datagram (like Records is already capped by MAX_GOSSIP_RECORDS_PER_REPLY).
- And/or make
yip_obf::obfuscate fail-soft on oversized bodies (return Option / skip-wrap) instead of .expect.
Relates to sub-project #2 (2c) gossip scaling.
Found by: 3a (anti-DPI) whole-branch review (PR #43).
Membership::tick_digestbuilds aGossipMsg::Digestfrom the entire directory with no per-datagram cap (only the u16 entry count is bounded). AtNodeId(16)+seq(8)=24bytes/entry, a directory of ≥~2731 reachable members produces a body >65535 bytes. Under obfuscation (obf_pskset),yip_obf::obfuscatedoesu16::try_from(body.len()).expect("body fits u16")→ panic.In the obf-off path the same oversized datagram degrades gracefully (a
sendtoEMSGSIZE, dropped). So 3a converts a silent degrade into a crash.Notes:
Fix options:
Digestper datagram (likeRecordsis already capped byMAX_GOSSIP_RECORDS_PER_REPLY).yip_obf::obfuscatefail-soft on oversized bodies (returnOption/ skip-wrap) instead of.expect.Relates to sub-project #2 (2c) gossip scaling.