Skip to content

fix: add bounds when allocating arrays in deserialization#21622

Merged
PhilWindle merged 2 commits intomerge-train/spartanfrom
palla/a-696-deserialization-max-size-bounds
Mar 17, 2026
Merged

fix: add bounds when allocating arrays in deserialization#21622
PhilWindle merged 2 commits intomerge-train/spartanfrom
palla/a-696-deserialization-max-size-bounds

Conversation

@spalladino
Copy link
Contributor

@spalladino spalladino commented Mar 16, 2026

Calling Array.from({length}) allocates length immediately. We were
calling this method in the context of deserialization with untrusted
input.

This PR changes it so we use new Array(size) for untrusted input. A
bit less efficient, but more secure.

@spalladino spalladino added ci-no-fail-fast Sets NO_FAIL_FAST in the CI so the run is not aborted on the first failure backport-to-v4-next backport-to-v4 and removed backport-to-v4-next labels Mar 16, 2026
Calling `Array.from({length})` allocates length immediately. We were
calling this method in the context of deserialization with untrusted
input.

This PR changes it so we use `new Array(size)` for untrusted input. A
bit less efficient, but more secure.
@spalladino spalladino force-pushed the palla/a-696-deserialization-max-size-bounds branch from 5786cad to 92f87f8 Compare March 17, 2026 02:11
@spalladino spalladino changed the title fix(stdlib): add maxSize bounds to network-reachable deserialization paths fix: add maxSize bounds when allocating arrays Mar 17, 2026
@spalladino spalladino changed the title fix: add maxSize bounds when allocating arrays fix: add bounds when allocating arrays in deserialization Mar 17, 2026
@PhilWindle PhilWindle merged commit 881eb02 into merge-train/spartan Mar 17, 2026
11 checks passed
@PhilWindle PhilWindle deleted the palla/a-696-deserialization-max-size-bounds branch March 17, 2026 09:53
AztecBot pushed a commit that referenced this pull request Mar 17, 2026
Calling `Array.from({length})` allocates length immediately. We were
calling this method in the context of deserialization with untrusted
input.

This PR changes it so we use `new Array(size)` for untrusted input. A
bit less efficient, but more secure.
@AztecBot
Copy link
Collaborator

✅ Successfully backported to backport-to-v4-next-staging #21654.

spalladino added a commit that referenced this pull request Mar 17, 2026
spalladino added a commit that referenced this pull request Mar 17, 2026
…21622) (#21666)

It was a red herring. 

We were not using `Array.from({ length })` but `Array.from({ length },
() => deserializer)`, and the deserializer would throw when reaching the
end of the buffer, preventing the full allocation of the array.
github-merge-queue bot pushed a commit that referenced this pull request Mar 18, 2026
BEGIN_COMMIT_OVERRIDE
fix(p2p): fall back to maxTxsPerCheckpoint for per-block tx validation
(#21605)
chore: fixing M3 devcontainer builds (#21611)
fix: clamp finalized block to oldest available in world-state (#21643)
chore: fix proving logs script (#21335)
fix: (A-649) tx collector bench test (#21619)
fix(validator): process block proposals from own validator keys in HA
setups (#21603)
fix: add bounds when allocating arrays in deserialization (#21622)
fix: skip handleChainFinalized when block is behind oldest available
(#21656)
chore: demote finalized block skip log to trace (#21661)
fix: skip -march auto-detection for cross-compilation presets (#21356)
chore: revert "add bounds when allocating arrays in deserialization"
(#21622) (#21666)
fix: capture txs not available error reason in proposal handler (#21670)
fix: estimate gas in bot and make BatchCall.simulate() return
SimulationResult (#21676)
fix: prevent HA peer proposals from blocking equivocation in duplicate
proposal test (#21673)
fix(p2p): penalize peers for errors during response reading (#21680)
feat(sequencer): add build-ahead config and metrics (#20779)
chore: fixing build on mac (#21685)
fix: HA deadlock for last block edge case (#21690)
fix: process all contract classes in storeBroadcastedIndividualFunctions
(A-683) (#21686)
chore: add slack success post on nightly scenario (#21701)
fix(builder): persist contractsDB across blocks within a checkpoint
(#21520)
fix: only delete logs from rolled-back blocks, not entire tag (A-686)
(#21687)
chore(p2p): lower attestation pool per-slot caps to 2 (#21709)
chore(p2p): remove unused method (#21678)
fix(p2p): penalize peer on tx rejected by pool (#21677)
fix(test): workaround slow mock creation (#21708)
fix(sequencer): fix checkpoint budget redistribution for multi-block
slots (#21692)
fix: batch checkpoint unwinding in handleEpochPrune (A-690) (#21668)
fix(sequencer): add missing opts arg to checkpoint_builder tests
(#21733)
fix: race condition in fast tx collection (#21496)
fix: increase default postgres disk size from 1Gi to 10Gi (#21741)
fix: update batch_tx_requester tests to use RequestTracker (#21734)
chore: replace dead BOOTSTRAP_TO env var with bootstrap.sh build arg
(#21744)
fix(sequencer): extract gas and blob configs from valid requests only
(A-677) (#21747)
fix: deflake attempt for l1_tx_utils (#21743)
fix(test): fix flaky keystore reload test (#21749)
fix(test): fix flaky duplicate_attestation_slash test (#21753)
feat(pipeline): introduce pipeline views for building (#21026)
END_COMMIT_OVERRIDE
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-to-v4-next ci-no-fail-fast Sets NO_FAIL_FAST in the CI so the run is not aborted on the first failure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants