Skip to content

Conversation

TheBlueMatt
Copy link
Collaborator

When ChaChaDualPolyReadAdapter encounters an EOF (Read::read returns Ok(0)) while trying to drain the stream (even though the FixedLengthReader thinks it has available space) we'll end up infinite-looping trying to drain the stream looking for Read::read to return an Err (which it won't).

The fix is, of course, simple, to detect the EOF signal.

Found by the onion_message_target fuzzer which @dergoegge ran. Thanks to @morehouse for digging deeper on the specific fuzz test case and thoroughly reporting the underlying causes.

Fixes #4139.

When `ChaChaDualPolyReadAdapter` encounters an EOF (`Read::read`
returns `Ok(0)`) while trying to drain the stream (even though the
`FixedLengthReader` thinks it has available space) we'll end up
infinite-looping trying to drain the stream looking for
`Read::read` to return an `Err` (which it won't).

The fix is, of course, simple, to detect the EOF signal.

Found by the `onion_message_target` fuzzer which @dergoegge ran.
Thanks to @morehouse for digging deeper on the specific fuzz test
case and thoroughly reporting the underlying causes.

Fixes lightningdevkit#4139.
@ldk-reviews-bot
Copy link

ldk-reviews-bot commented Oct 6, 2025

I've assigned @valentinewallace as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

Copy link

codecov bot commented Oct 6, 2025

Codecov Report

❌ Patch coverage is 83.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.64%. Comparing base (7439528) to head (423844d).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
lightning/src/crypto/streams.rs 83.33% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4144   +/-   ##
=======================================
  Coverage   88.63%   88.64%           
=======================================
  Files         180      180           
  Lines      135230   135241   +11     
  Branches   135230   135241   +11     
=======================================
+ Hits       119865   119885   +20     
+ Misses      12594    12590    -4     
+ Partials     2771     2766    -5     
Flag Coverage Δ
fuzzing 21.76% <0.00%> (-0.01%) ⬇️
tests 88.48% <83.33%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

@morehouse morehouse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM and verified the fuzz target no longer times out.

Copy link
Contributor

@tnull tnull left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simple fix, landing.

@tnull tnull merged commit 2efb009 into lightningdevkit:main Oct 7, 2025
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Infinite onion message parse
4 participants