Merge pull request #6510 from oasisprotocol/peternose/bugfix/incomming-msgs

go/consensus/cometbft/apps/roothash: Validate runtime ID of messages

Author: peternose

.changelog/6510.bugfix.md

@@ -0,0 +1 @@
+go/consensus/cometbft/apps/roothash: Validate runtime ID of messages

go/consensus/cometbft/apps/roothash/state/state.go

@@ -244,6 +244,8 @@ func (s *ImmutableState) IncomingMessageQueueMeta(ctx context.Context, runtimeID
 
 // IncomingMessageQueue returns a list of queued messages, starting with the passed offset.
 func (s *ImmutableState) IncomingMessageQueue(ctx context.Context, runtimeID common.Namespace, offset uint64, limit uint32) ([]*message.IncomingMessage, error) {
+	hashedRuntimeID := keyformat.PreHashed(runtimeID.Hash())
+
 	it := s.state.NewIterator(ctx)
 	defer it.Close()
 
@@ -256,6 +258,9 @@ func (s *ImmutableState) IncomingMessageQueue(ctx context.Context, runtimeID com
 		if !inMsgQueueKeyFmt.Decode(it.Key(), &decRuntimeID, &decID) {
 			break
 		}
+		if decRuntimeID != hashedRuntimeID {
+			break
+		}
 		if decID < offset {
 			continue
 		}