Security: Delta and chunk deserialization don't validate array counts/sizes from network #170

New Issue

2026-07-29T18:36:36+02:00

TapTap commented

2026-07-29 18:36:36 +02:00

Description

Several deserialization functions trust length/count fields from the wire without validating them against the available data or a global cap:

delta_signature_deserialize() (src/shared/delta.c:86-124) reads block_count and allocates block_count * sizeof(DeltaBlockSig) without a cap.
delta_deserialize() (src/shared/delta.c:322-421) reads instruction_count and allocates instruction_count * sizeof(DeltaInstruction) without a cap.
chunk_deserialize() (src/shared/chunk.c:86-183) reads path_len and file_data_size as size_t from the chunk payload and allocates them directly.

A malicious peer can craft small payloads with huge counts/sizes, causing OOM or allocation failures that are not handled gracefully.

Suggested fix

Define a maximum number of blocks, instructions, files per chunk, and file/path size.
Validate every length/count field against the remaining buffer size before allocating.
Return NULL and log an error on malformed input.

Severity

Medium

Category

security

This issue was automatically generated by the issue-creator agent.

## Description Several deserialization functions trust length/count fields from the wire without validating them against the available data or a global cap: - `delta_signature_deserialize()` (`src/shared/delta.c:86-124`) reads `block_count` and allocates `block_count * sizeof(DeltaBlockSig)` without a cap. - `delta_deserialize()` (`src/shared/delta.c:322-421`) reads `instruction_count` and allocates `instruction_count * sizeof(DeltaInstruction)` without a cap. - `chunk_deserialize()` (`src/shared/chunk.c:86-183`) reads `path_len` and `file_data_size` as `size_t` from the chunk payload and allocates them directly. A malicious peer can craft small payloads with huge counts/sizes, causing OOM or allocation failures that are not handled gracefully. ## Suggested fix 1. Define a maximum number of blocks, instructions, files per chunk, and file/path size. 2. Validate every length/count field against the remaining buffer size before allocating. 3. Return `NULL` and log an error on malformed input. ## Severity Medium ## Category security --- _This issue was automatically generated by the issue-creator agent._