fix zero size element vector deserialize security issue #41
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ailisp
commented
Nov 4, 2019
| Ok(result) | ||
| } | ||
| } else { | ||
| let mut result = Vec::with_capacity(hint::cautious::<T>(len)); |
There was a problem hiding this comment.
this hint::cautious also would divide by zero, when size_of::() is 0. This is the only place affected and happens to be fixed here too.
MaksymZavershynskyi
suggested changes
Nov 5, 2019
MaksymZavershynskyi
suggested changes
Nov 5, 2019
| @@ -36,7 +36,7 @@ Why do we need yet another serialization format? Borsh is the first serializer t | |||
| * Consistent means there is a bijective mapping between objects and their binary representations. There is no two binary representations that deserialize | |||
| into the same object. This is extremely useful for applications that use binary representation to compute hash; | |||
| * Borsh comes with a full specification that can be used for implementations in other languages; | |||
| * Safe. Borsh implementations use safe coding practices. In Rust, Borsh uses only safe code; | |||
There was a problem hiding this comment.
Also the website, please.
There was a problem hiding this comment.
Thanks. just updated, is website auto deployed?
There was a problem hiding this comment.
sorry seems it's auto reformat on save by editor, i'll change it back now
MaksymZavershynskyi
approved these changes
Nov 13, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.