Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions src/multihash.rs
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,8 @@ impl<const S: usize> Multihash<S> {
}

// Don't hash the whole allocated space, but just the actual digest
#[allow(clippy::derive_hash_xor_eq)]
#[allow(unknown_lints, renamed_and_removed_lints)]
#[allow(clippy::derived_hash_with_manual_eq, clippy::derive_hash_xor_eq)]
impl<const S: usize> core::hash::Hash for Multihash<S> {
fn hash<T: core::hash::Hasher>(&self, state: &mut T) {
self.code.hash(state);
Expand Down Expand Up @@ -362,7 +363,9 @@ pub(crate) fn read_u64<R: io::Read>(mut r: R) -> Result<u64, Error> {
if n == 0 {
return Err(Error::Varint(decode::Error::Insufficient));
} else if decode::is_last(b[i]) {
return Ok(decode::u64(&b[..=i]).unwrap().0);
return decode::u64(&b[..=i])
.map(|decoded| decoded.0)
.map_err(Error::Varint);
Comment on lines +366 to +368

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested this change with our project and it fixes the panic, Thanks!

}
}
Err(Error::Varint(decode::Error::Overflow))
Expand Down Expand Up @@ -452,4 +455,12 @@ mod tests {
let mh2 = Multihash::<64>::default();
assert_eq!(mh1, mh2);
}

#[test]
fn decode_non_minimal_error() {
// This is a non-minimal varint.
let data = [241, 0, 0, 0, 0, 0, 128, 132, 132, 132, 58];

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just another data point, here's the data that we found from fuzz testing that caused the panic:
let data = [0, 1, 0, 1, 203, 155, 0, 0, 0, 5, 67];

let result = read_u64(&data[..]);
assert!(result.is_err());
}
}
2 changes: 1 addition & 1 deletion tests/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ where
H: Hasher + Default,
{
let digest = hex::decode(digest_str).unwrap();
let expected_bytes = hex::decode(&format!("{}{}", prefix, digest_str)).unwrap();
let expected_bytes = hex::decode(format!("{}{}", prefix, digest_str)).unwrap();
let mut expected_cursor = Cursor::new(&expected_bytes);
let multihash = code.digest(b"hello world");

Expand Down