certusone
/
wormhole
mirror of https://github.com/certusone/wormhole.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

node/p2p: enforce ObservationRequest signature payload >= 34 bytes (#1992) 

Co-authored-by: tbjump <>
This commit is contained in:
tbjump 2022-11-28 10:42:39 -06:00 committed by GitHub
parent 200fee61a8
commit 17e732c741
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
node/pkg/p2p/p2p.go
View File

@ -484,6 +484,11 @@ func processSignedObservationRequest(s *gossipv1.SignedObservationRequest, gs *n
pk = gs.Keys[idx]
}
// SECURITY: see whitepapers/0009_guardian_key.md
if len(signedObservationRequestPrefix)+len(s.ObservationRequest) < 34 {
return nil, fmt.Errorf("invalid observation request: too short")
}
digest := signedObservationRequestDigest(s.ObservationRequest)
pubKey, err := ethcrypto.Ecrecover(digest.Bytes(), s.Signature)