From 8f07e832a242cba12e198095751c8b0190b2426d Mon Sep 17 00:00:00 2001 From: Alec Muffett Date: Sat, 30 May 2026 22:22:54 +0400 Subject: [PATCH] bucket-A4: cap Packet read-constructor prefix_length (SAFE-ADDITIVE, Bug-9 hardening) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a bounds guard to Packet(size_t prefix_length): caps prefix_length at 16 and throws std::ios_base::failure if exceeded, instead of letting prefix.resize() throw std::length_error ("vector::_M_default_append") and kill the process. prefix_length flows from m_node->get_prefix().size() in Socket::init(). In the Bug-3 UAF class (rapid disconnect-reconnect destroys m_node mid-handshake), the vector's size field reads garbage and the unguarded resize() aborts. All known protocols use a 4-byte magic prefix, so the cap at 16 never triggers in normal operation — this only converts a UAF-garbage crash into a clean connection failure. LTC+DOGE behavior on valid traffic is identical. Cherry-picked from dash-spv-embedded HEAD 8249dc28. 1 file, +11: - modified src/core/packet.hpp --- src/core/packet.hpp | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/core/packet.hpp b/src/core/packet.hpp index 5119ebf51..132ae4490 100644 --- a/src/core/packet.hpp +++ b/src/core/packet.hpp @@ -44,6 +44,17 @@ class Packet // read Packet(size_t prefix_length) { + // Bug 9 hardening: prefix_length comes from m_node->get_prefix().size() + // in Socket::init(). If m_node has been destroyed mid-handshake (UAF + // from rapid disconnect-reconnect — Bug-3-family), the vector's size + // field reads garbage and resize() throws std::length_error + // ("vector::_M_default_append") which kills the process. All known + // protocols have a 4-byte magic prefix; cap at 16 to reject UAF + // garbage cleanly and let the connection fail without crashing. + constexpr size_t MAX_PREFIX_LENGTH = 16; + if (prefix_length > MAX_PREFIX_LENGTH) { + throw std::ios_base::failure("Packet prefix_length exceeds cap (likely UAF on m_node)"); + } prefix.resize(prefix_length); }