Skip to content

OOB access in AttributionData::verify #3708

New issue
New issue
Closed
#3709
Closed
OOB access in AttributionData::verify#3708
#3709
Assignees
joostjager
Milestone
 
0.2
@TheBlueMatt

Description

@TheBlueMatt
TheBlueMatt
opened on Apr 4, 2025

The process_onion_failure fuzzer found the following OOB access in the new attributable failures code:

thread '<unnamed>' panicked at 'range end index 116 out of range for slice of length 80', library/core/src/slice/index.rs:73:5
stack backtrace:
   0: rust_begin_unwind
             at /usr/src/rustc-1.63.0/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /usr/src/rustc-1.63.0/library/core/src/panicking.rs:142:14
   2: core::slice::index::slice_end_index_len_fail_rt
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:73:5
   3: core::ops::function::FnOnce::call_once
             at /usr/src/rustc-1.63.0/library/core/src/ops/function.rs:248:5
   4: core::intrinsics::const_eval_select
             at /usr/src/rustc-1.63.0/library/core/src/intrinsics.rs:2376:5
   5: core::slice::index::slice_end_index_len_fail
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:67:9
   6: <core::ops::range::Range<usize> as core::slice::index::SliceIndex<[T]>>::index
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:304:13
   7: <core::ops::range::RangeTo<usize> as core::slice::index::SliceIndex<[T]>>::index
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:351:9
   8: core::slice::index::<impl core::ops::index::Index<I> for [T]>::index
             at /usr/src/rustc-1.63.0/library/core/src/slice/index.rs:18:9
   9: core::array::<impl core::ops::index::Index<I> for [T; N]>::index
             at /usr/src/rustc-1.63.0/library/core/src/array/mod.rs:286:9
  10: lightning::ln::onion_utils::AttributionData::verify
             at /root/rust-lightning/lightning/src/ln/onion_utils.rs:2325:15
  11: lightning::ln::onion_utils::process_onion_failure_inner
             at /root/rust-lightning/lightning/src/ln/onion_utils.rs:1223:21
  12: lightning::ln::onion_utils::process_onion_failure
             at /root/rust-lightning/lightning/src/ln/onion_utils.rs:1026:3
  13: lightning_fuzz::process_onion_failure::do_test
             at ./src/process_onion_failure.rs:132:2
  14: lightning_fuzz::process_onion_failure::process_onion_failure_test
             at ./src/process_onion_failure.rs:137:2
  15: process_onion_failure_target::run_test_cases::{{closure}}::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:92:7
  16: std::panicking::try::do_call
             at /usr/src/rustc-1.63.0/library/std/src/panicking.rs:492:40
  17: std::panicking::try
             at /usr/src/rustc-1.63.0/library/std/src/panicking.rs:456:19
  18: std::panic::catch_unwind
             at /usr/src/rustc-1.63.0/library/std/src/panic.rs:137:14
  19: process_onion_failure_target::run_test_cases::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:91:19
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

# xxd -p test_cases/process_onion_failure/SIGABRT.PC.7ffff7e45e3c.STACK.d64ce0d4f.CODE.-6.ADDR.0.INSTR.mov____%eax,%ebp.fuzz
1d000021000000000005102914e176baef5df3605165fce1af58fb2da98e
58b8cb2a678131fbceb9bb2de6c4e6b62a001c42c3efd998045e2c1610f4
621fdc073ba895059619673c990171b0bfefef9ba1cac639e4b675c905a5
ef093f817b46eb84c42f29fb3634a25b6622fce2a2dbc7b8bf7bf533a4f0
543521034b63c7110368a23afab210f2129b00d4b5c75c7559669160cff0
481ea5f6ef1d6ccd1964036a07c076c994620c7f15ac1bfed581ffc924d0
effb82663b1507cbd2a999c067ab8ffc55e38e78e0506c5c65043cefb441
ff59d3404549d82c96c89e30318615c27e550e7bbb828dcc923e651d0000
000000010000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000007a080000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000d34d00
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000ff
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000010400000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000ff00000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000018fcffffffffffff00000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000ffffff00feba0e03000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000009a0000000104
00000000000200000000000000000000000000839f0000ff010004000000
0040000000000000

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions