From 8094c1c4c55ba0de249ad9ad6274d46db51fa223 Mon Sep 17 00:00:00 2001 From: kasey Date: Wed, 26 May 2021 16:47:06 -0500 Subject: [PATCH] regenerate ssz types w/ variable-len bounds checks (#8936) * regenerate ssz types w/ variable-len bounds checks using the code in this PR: https://github.com/ferranbt/fastssz/pull/45 * updating with improved bounds checking * updating pinned fastssz dependency to newest * removing redundant higher bounds checks * regenerate again w/ new fastssz --- fuzz/generated.ssz.go | 5 +++++ go.mod | 5 +++-- go.sum | 10 ++++++++-- proto/beacon/p2p/v1/generated.ssz.go | 9 +++++++++ 4 files changed, 25 insertions(+), 4 deletions(-) diff --git a/fuzz/generated.ssz.go b/fuzz/generated.ssz.go index 619b0ebb01..a38446dec4 100644 --- a/fuzz/generated.ssz.go +++ b/fuzz/generated.ssz.go @@ -1,4 +1,5 @@ // Code generated by fastssz. DO NOT EDIT. +// Hash: 4c0e0bd2735c90105ba59d0074491eb2a45ef4ce93979be7fc6b9cd96e3bd1ee package fuzz import ( @@ -60,6 +61,10 @@ func (i *InputBlockWithPrestate) UnmarshalSSZ(buf []byte) error { return ssz.ErrOffset } + if o0 < 8 { + return ssz.ErrInvalidVariableOffset + } + // Offset (1) 'Block' if o1 = ssz.ReadOffset(buf[4:8]); o1 > size || o0 > o1 { return ssz.ErrOffset diff --git a/go.mod b/go.mod index 394ea76744..8b673a00d9 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/emicklei/dot v0.11.0 github.com/ethereum/go-ethereum v1.9.25 github.com/fatih/color v1.9.0 // indirect - github.com/ferranbt/fastssz v0.0.0-20210120143747-11b9eff30ea9 + github.com/ferranbt/fastssz v0.0.0-20210526181520-7df50c8568f8 github.com/fjl/memsize v0.0.0-20190710130421-bcb5799ab5e5 github.com/fsnotify/fsnotify v1.4.9 github.com/gballet/go-libpcsclite v0.0.0-20191108122812-4678299bea08 // indirect @@ -52,6 +52,7 @@ require ( github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 github.com/karalabe/usb v0.0.0-20191104083709-911d15fe12a9 // indirect github.com/kevinms/leakybucket-go v0.0.0-20200115003610-082473db97ca + github.com/klauspost/cpuid/v2 v2.0.6 // indirect github.com/koron/go-ssdp v0.0.2 // indirect github.com/kr/pretty v0.2.1 github.com/kr/text v0.2.0 // indirect @@ -71,7 +72,7 @@ require ( github.com/lunixbochs/vtclean v1.0.0 // indirect github.com/manifoldco/promptui v0.7.0 github.com/minio/highwayhash v1.0.1 - github.com/minio/sha256-simd v0.1.1 + github.com/minio/sha256-simd v1.0.0 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 github.com/multiformats/go-multiaddr v0.3.1 github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d diff --git a/go.sum b/go.sum index 31abe415f0..74b3d12b57 100644 --- a/go.sum +++ b/go.sum @@ -268,8 +268,9 @@ github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLi github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/fatih/color v1.9.0 h1:8xPHl4/q1VyqGIPif1F+1V3Y3lSmrq01EabUW3CoW5s= github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= -github.com/ferranbt/fastssz v0.0.0-20210120143747-11b9eff30ea9 h1:9VDpsWq096+oGMDTT/SgBD/VgZYf4pTF+KTPmZ+OaKM= github.com/ferranbt/fastssz v0.0.0-20210120143747-11b9eff30ea9/go.mod h1:DyEu2iuLBnb/T51BlsiO3yLYdJC6UbGMrIkqK1KmQxM= +github.com/ferranbt/fastssz v0.0.0-20210526181520-7df50c8568f8 h1:zhTRgKvm7CQxlGwJ7KfqT1AYDr2Q/caS6qrC7fwEtxU= +github.com/ferranbt/fastssz v0.0.0-20210526181520-7df50c8568f8/go.mod h1:DyEu2iuLBnb/T51BlsiO3yLYdJC6UbGMrIkqK1KmQxM= github.com/fjl/memsize v0.0.0-20190710130421-bcb5799ab5e5 h1:FtmdgXiUlNeRsoNMFlKLDt+S+6hbjVMEW6RGQ7aUf7c= github.com/fjl/memsize v0.0.0-20190710130421-bcb5799ab5e5/go.mod h1:VvhXpOYNQvB+uIk2RvXzuaQtkQJzzIx6lSBe1xv7hi0= github.com/flynn/noise v0.0.0-20180327030543-2492fe189ae6 h1:u/UEqS66A5ckRmS4yNpjmVH56sVtS/RfclBAYocb4as= @@ -604,7 +605,11 @@ github.com/klauspost/compress v1.9.8/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0 github.com/klauspost/compress v1.10.1/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs= github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs= github.com/klauspost/cpuid v0.0.0-20170728055534-ae7887de9fa5/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek= +github.com/klauspost/cpuid v1.2.3 h1:CCtW0xUnWGVINKvE/WWOYKdsPV6mawAtvQuSl8guwQs= github.com/klauspost/cpuid v1.2.3/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek= +github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= +github.com/klauspost/cpuid/v2 v2.0.6 h1:dQ5ueTiftKxp0gyjKSx5+8BtPWkyQbd95m8Gys/RarI= +github.com/klauspost/cpuid/v2 v2.0.6/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= github.com/klauspost/crc32 v0.0.0-20161016154125-cb6bfca970f6/go.mod h1:+ZoRqAPRLkC4NPOvfYeR5KNOrY6TD+/sAC3HXPZgDYg= github.com/klauspost/pgzip v1.0.2-0.20170402124221-0bf5dcad4ada/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs= github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs= @@ -864,8 +869,9 @@ github.com/minio/sha256-simd v0.0.0-20190131020904-2d45a736cd16/go.mod h1:2FMWW+ github.com/minio/sha256-simd v0.0.0-20190328051042-05b4dd3047e5/go.mod h1:2FMWW+8GMoPweT6+pI63m9YE3Lmw4J71hV56Chs1E/U= github.com/minio/sha256-simd v0.1.0/go.mod h1:2FMWW+8GMoPweT6+pI63m9YE3Lmw4J71hV56Chs1E/U= github.com/minio/sha256-simd v0.1.1-0.20190913151208-6de447530771/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM= -github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU= github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM= +github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g= +github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM= github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc= github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ= github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw= diff --git a/proto/beacon/p2p/v1/generated.ssz.go b/proto/beacon/p2p/v1/generated.ssz.go index ac2c045479..a90411332d 100644 --- a/proto/beacon/p2p/v1/generated.ssz.go +++ b/proto/beacon/p2p/v1/generated.ssz.go @@ -1,4 +1,5 @@ // Code generated by fastssz. DO NOT EDIT. +// Hash: 8a6d892aeb6b44fa52d8739c644593e8d8389d02923b7611a25b2697a2e9de94 package ethereum_beacon_p2p_v1 import ( @@ -662,6 +663,10 @@ func (b *BeaconState) UnmarshalSSZ(buf []byte) error { return ssz.ErrOffset } + if o7 < 2687377 { + return ssz.ErrInvalidVariableOffset + } + // Field (8) 'Eth1Data' if b.Eth1Data == nil { b.Eth1Data = new(v1alpha1.Eth1Data) @@ -1257,6 +1262,10 @@ func (p *PendingAttestation) UnmarshalSSZ(buf []byte) error { return ssz.ErrOffset } + if o0 < 148 { + return ssz.ErrInvalidVariableOffset + } + // Field (1) 'Data' if p.Data == nil { p.Data = new(v1alpha1.AttestationData)