From 25dab9fe5b606a2c943d4720cd49d223cb0a4daa Mon Sep 17 00:00:00 2001 From: jwinterm Date: Tue, 2 Jun 2026 20:58:22 -0400 Subject: [PATCH] Harden v5 payment-proof deserialization against malformed input ProofWrap::read unwrapped on the sender/receiver address, promise signature, and memo_type while parsing untrusted slatepack bytes, so a malformed payment proof would panic the wallet. Propagate CorruptedData instead, matching the timestamp path already in this function. --- libwallet/src/slate_versions/v5_bin.rs | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/libwallet/src/slate_versions/v5_bin.rs b/libwallet/src/slate_versions/v5_bin.rs index d033029..600cd18 100644 --- a/libwallet/src/slate_versions/v5_bin.rs +++ b/libwallet/src/slate_versions/v5_bin.rs @@ -245,8 +245,10 @@ impl<'a> Writeable for ProofWrapRef<'a> { impl Readable for ProofWrap { fn read(reader: &mut R) -> Result { - let saddr = DalekPublicKey::from_bytes(&reader.read_fixed_bytes(32)?).unwrap(); - let raddr = DalekPublicKey::from_bytes(&reader.read_fixed_bytes(32)?).unwrap(); + let saddr = DalekPublicKey::from_bytes(&reader.read_fixed_bytes(32)?) + .map_err(|_| grin_ser::Error::CorruptedData)?; + let raddr = DalekPublicKey::from_bytes(&reader.read_fixed_bytes(32)?) + .map_err(|_| grin_ser::Error::CorruptedData)?; let ts_raw: i64 = match reader.read_i64() { Ok(v) => v, Err(_) => return Err(grin_ser::Error::CorruptedData), @@ -258,12 +260,15 @@ impl Readable for ProofWrap { let ts = DateTime::::from_utc(ts_opt, Utc); let psig = match reader.read_u8()? { 0 => None, - 1 | _ => Some(DalekSignature::try_from(&reader.read_fixed_bytes(64)?[..]).unwrap()), + 1 | _ => Some( + DalekSignature::try_from(&reader.read_fixed_bytes(64)?[..]) + .map_err(|_| grin_ser::Error::CorruptedData)?, + ), }; let memo = match reader.read_u8()? { 0 => None, 1 | _ => Some(PaymentMemoV5 { - memo_type: reader.read_u8().unwrap(), + memo_type: reader.read_u8()?, memo: reader.read_fixed_bytes(32)?.try_into().unwrap_or_default(), }), };