Browse Source

Add a way to limit deserialized string lengths

and use it for most strings being serialized.
tags/v0.15.1
Pieter Wuille 6 years ago
parent
commit
216e9a4456
4 changed files with 46 additions and 14 deletions
  1. 3
    3
      src/alert.h
  2. 3
    6
      src/main.cpp
  3. 37
    2
      src/serialize.h
  4. 3
    3
      src/wallet.h

+ 3
- 3
src/alert.h View File

@@ -60,9 +60,9 @@ public:
READWRITE(setSubVer);
READWRITE(nPriority);

READWRITE(strComment);
READWRITE(strStatusBar);
READWRITE(strReserved);
READWRITE(LIMITED_STRING(strComment, 65536));
READWRITE(LIMITED_STRING(strStatusBar, 256));
READWRITE(LIMITED_STRING(strReserved, 256));
)

void SetNull();

+ 3
- 6
src/main.cpp View File

@@ -3559,7 +3559,7 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv,
if (!vRecv.empty())
vRecv >> addrFrom >> nNonce;
if (!vRecv.empty()) {
vRecv >> pfrom->strSubVer;
vRecv >> LIMITED_STRING(pfrom->strSubVer, 256);
pfrom->cleanSubVer = SanitizeString(pfrom->strSubVer);
}
if (!vRecv.empty())
@@ -4183,7 +4183,7 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv,
if (fDebug)
{
string strMsg; unsigned char ccode; string strReason;
vRecv >> strMsg >> ccode >> strReason;
vRecv >> LIMITED_STRING(strMsg, CMessageHeader::COMMAND_SIZE) >> ccode >> LIMITED_STRING(strReason, 111);

ostringstream ss;
ss << strMsg << " code " << itostr(ccode) << ": " << strReason;
@@ -4194,10 +4194,7 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv,
vRecv >> hash;
ss << ": hash " << hash.ToString();
}
// Truncate to reasonable length and sanitize before printing:
string s = ss.str();
if (s.size() > 111) s.erase(111, string::npos);
LogPrint("net", "Reject %s\n", SanitizeString(s));
LogPrint("net", "Reject %s\n", SanitizeString(ss.str()));
}
}


+ 37
- 2
src/serialize.h View File

@@ -334,8 +334,9 @@ I ReadVarInt(Stream& is)
}
}

#define FLATDATA(obj) REF(CFlatData((char*)&(obj), (char*)&(obj) + sizeof(obj)))
#define VARINT(obj) REF(WrapVarInt(REF(obj)))
#define FLATDATA(obj) REF(CFlatData((char*)&(obj), (char*)&(obj) + sizeof(obj)))
#define VARINT(obj) REF(WrapVarInt(REF(obj)))
#define LIMITED_STRING(obj,n) REF(LimitedString< n >(REF(obj)))

/** Wrapper for serializing arrays and POD.
*/
@@ -398,6 +399,40 @@ public:
}
};

template<size_t Limit>
class LimitedString
{
protected:
std::string& string;
public:
LimitedString(std::string& string) : string(string) {}

template<typename Stream>
void Unserialize(Stream& s, int, int=0)
{
size_t size = ReadCompactSize(s);
if (size > Limit) {
throw std::ios_base::failure("String length limit exceeded");
}
string.resize(size);
if (size != 0)
s.read((char*)&string[0], size);
}

template<typename Stream>
void Serialize(Stream& s, int, int=0) const
{
WriteCompactSize(s, string.size());
if (!string.empty())
s.write((char*)&string[0], string.size());
}

unsigned int GetSerializeSize(int, int=0) const
{
return GetSizeOfCompactSize(string.size()) + string.size();
}
};

template<typename I>
CVarInt<I> WrapVarInt(I& n) { return CVarInt<I>(n); }


+ 3
- 3
src/wallet.h View File

@@ -858,7 +858,7 @@ public:
READWRITE(vchPrivKey);
READWRITE(nTimeCreated);
READWRITE(nTimeExpires);
READWRITE(strComment);
READWRITE(LIMITED_STRING(strComment, 65536));
)
};

@@ -933,7 +933,7 @@ public:
// Note: strAccount is serialized as part of the key, not here.
READWRITE(nCreditDebit);
READWRITE(nTime);
READWRITE(strOtherAccount);
READWRITE(LIMITED_STRING(strOtherAccount, 65536));

if (!fRead)
{
@@ -949,7 +949,7 @@ public:
}
}

READWRITE(strComment);
READWRITE(LIMITED_STRING(strComment, 65536));

size_t nSepPos = strComment.find("\0", 0, 1);
if (fRead)

Loading…
Cancel
Save