stellar-strkey vulnerable to panic in SignedPayload::from_payload

Panic vulnerability when a specially crafted payload is used.
This is because of the following calculation:

inner_payload_len + (4 - inner_payload_len % 4) % 4

If inner_payload_len is 0xffffffff, (4 - inner_payload_len % 4) % 4 = 1 so

inner_payload_len + (4 - inner_payload_len % 4) % 4 = u32::MAX + 1

which overflow.

Check that inner_payload_len is not above 64 which should never be the case.
Patched in version 0.0.8

Sanitize input payload before it is passed to the vulnerable function so that bytes in payload[32..32+4] and parsed as a u32 is not above 64.

GitHub issue #58

C0x41lch0x41 published to stellar/rs-stellar-strkey Oct 24, 2023

Published to the GitHub Advisory Database Oct 25, 2023

Reviewed Oct 25, 2023

Published by the National Vulnerability Database Oct 25, 2023

Last updated Nov 9, 2023

Provide feedback