fix(common): bound RLP transaction allocations - #1028
Conversation
Reject transaction lengths that exceed the remaining batch payload before allocating memory, preventing malformed committed data from exhausting derivation nodes. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Warning Review limit reached
Next review available in: 17 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
extractInnerTxFullBytes sized the full-tx buffer with 1+uint32(sizeByteLen)+size, which wraps when the declared RLP size is near MaxUint32 (e.g. a 0xffffffff length prefix), producing a buffer shorter than the slice copies below and panicking. The remaining-length guard added in #1028 already bounds size to the available input on the batch-decode path, so this only wraps for an out-of-band reader; computing the length in uint64 removes the panic unconditionally as defense in depth. Co-authored-by: Cursor <cursoragent@cursor.com>
End-to-end analysis shows the uint32 length wrap at blob.go is unreachable: the compressed batch input is hard-capped by the L1 blobs-per-tx limit, the #1028 size>remaining guard already bounds the declared length to the decompressed stream, and reaching a ~4.29 GiB stream would OOM inside zstd decompression before the RLP decoder runs. The #1028 guard on main is the sufficient defense; the extra hardening addressed a condition the real data flow cannot produce, so revert it and keep this PR to the oracle fix. Co-authored-by: Cursor <cursoragent@cursor.com>
size is a uint32, so 1+sizeByteLen+size can exceed MaxUint32 and wrap to a tiny buffer length, leaving fullTxBytes shorter than the copies that follow and panicking. The #1028 remaining-bytes guard keeps this unreachable on the current decode path, but compute the length in uint64 and reject the overflow before allocating so the decoder stays safe if the size type or the upstream length bounds ever change. Co-authored-by: Cursor <cursoragent@cursor.com>
2 participants
Summary
Security impact
A malformed committed batch can encode a four-byte RLP length such as
0xffffffffwith almost no payload. Without this check, derivation attempts the declared allocation before the subsequent read fails. The check uses the exact remainingbytes.Readerlength rather than an arbitrary protocol cap.Test plan
go test ./batch -run '^TestExtractInnerTxFullBytes' -count=1 -timeout=30sMade with Cursor