security: fixes OOM DoS vulnerability. upgrade gnark-crypto v0.12.1 → v0.20.1

.github/workflows/audit-bootnodes.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
         id: go
 
       - name: Check out code into the Go module directory

.github/workflows/bench-core.yml

@@ -14,7 +14,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -38,7 +38,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -66,7 +66,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2

.github/workflows/bench-trie.yml

@@ -14,7 +14,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -38,7 +38,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -66,7 +66,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2

.github/workflows/bench-vm.yml

@@ -14,7 +14,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -40,7 +40,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -72,7 +72,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2

.github/workflows/evmc.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
         id: go
 
       - name: Check out code into the Go module directory

.github/workflows/go-generate-check.yml

@@ -19,7 +19,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
       - name: Check out code into the Go module directory
         uses: actions/checkout@v3
         with:

.github/workflows/release-packages.yml

@@ -38,7 +38,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - name: Cache lookup (Linux/ARM)
         uses: actions/cache@v3

.github/workflows/test-linux.yml

@@ -21,7 +21,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - uses: actions/checkout@v2
         with:
@@ -38,7 +38,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - uses: actions/checkout@v2
         with:
@@ -55,7 +55,7 @@ jobs:
         id: go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.26'
 
       - uses: actions/checkout@v2
         with:

Dockerfile

@@ -4,7 +4,7 @@ ARG VERSION=""
 ARG BUILDNUM=""
 
 # Build Geth in a stock Go builder container
-FROM golang:1.22-alpine as builder
+FROM golang:1.26-alpine as builder
 
 RUN apk add --no-cache gcc musl-dev linux-headers git
 

Dockerfile.alltools

@@ -4,7 +4,7 @@ ARG VERSION=""
 ARG BUILDNUM=""
 
 # Build Geth in a stock Go builder container
-FROM golang:1.22-alpine as builder
+FROM golang:1.26-alpine as builder
 
 RUN apk add --no-cache gcc musl-dev linux-headers git
 

accounts/abi/unpack_test.go

@@ -947,7 +947,7 @@ func TestOOMMaliciousInput(t *testing.T) {
 		}
 		encb, err := hex.DecodeString(test.enc)
 		if err != nil {
-			t.Fatalf("invalid hex: %s" + test.enc)
+			t.Fatalf("invalid hex: %s", test.enc)
 		}
 		_, err = abi.Methods["method"].Outputs.UnpackValues(encb)
 		if err == nil {

cmd/evm/t8n_test.go

@@ -417,7 +417,7 @@ func TestT9n(t *testing.T) {
 			ok, err := cmpJson(have, want)
 			switch {
 			case err != nil:
-				t.Logf(string(have))
+				t.Logf("%s", string(have))
 				t.Fatalf("test %d, json parsing failed: %v", i, err)
 			case !ok:
 				t.Fatalf("test %d: output wrong, have \n%v\nwant\n%v\n", i, string(have), string(want))
@@ -552,7 +552,7 @@ func TestB11r(t *testing.T) {
 			ok, err := cmpJson(have, want)
 			switch {
 			case err != nil:
-				t.Logf(string(have))
+				t.Logf("%s", string(have))
 				t.Fatalf("test %d, json parsing failed: %v", i, err)
 			case !ok:
 				t.Fatalf("test %d: output wrong, have \n%v\nwant\n%v\n", i, string(have), string(want))

cmd/geth/logging_test.go

@@ -90,7 +90,7 @@ func testConsoleLogging(t *testing.T, format string, tStart, tEnd int) {
 		have = censor(have, tStart, tEnd)
 		want = censor(want, tStart, tEnd)
 		if have != want {
-			t.Logf(nicediff([]byte(have), []byte(want)))
+			t.Logf("%s", nicediff([]byte(have), []byte(want)))
 			t.Fatalf("format %v, line %d\nhave %v\nwant %v", format, i, have, want)
 		}
 	}
@@ -140,7 +140,7 @@ func TestJsonLogging(t *testing.T) {
 		}
 		if !bytes.Equal(have, want) {
 			// show an intelligent diff
-			t.Logf(nicediff(have, want))
+			t.Logf("%s", nicediff(have, want))
 			t.Errorf("file content wrong")
 		}
 	}
@@ -210,7 +210,7 @@ func TestFileOut(t *testing.T) {
 	}
 	if !bytes.Equal(have, want) {
 		// show an intelligent diff
-		t.Logf(nicediff(have, want))
+		t.Logf("%s", nicediff(have, want))
 		t.Errorf("file content wrong")
 	}
 }
@@ -231,7 +231,7 @@ func TestRotatingFileOut(t *testing.T) {
 	}
 	if !bytes.Equal(have, want) {
 		// show an intelligent diff
-		t.Logf(nicediff(have, want))
+		t.Logf("%s", nicediff(have, want))
 		t.Errorf("file content wrong")
 	}
 }

cmd/geth/main.go

@@ -409,8 +409,6 @@ func geth(ctx *cli.Context) error {
 // it unlocks any requested accounts, and starts the RPC/IPC interfaces and the
 // miner.
 func startNode(ctx *cli.Context, stack *node.Node, backend ethapi.Backend, isConsole bool) {
-	debug.Memsize.Add("node", stack)
-
 	// Start up the node itself
 	utils.StartNode(ctx, stack, isConsole)
 

cmd/rlpdump/main.go

@@ -142,7 +142,7 @@ func dump(in *inStream, s *rlp.Stream, depth int, out io.Writer) error {
 		s.List()
 		defer s.ListEnd()
 		if size == 0 {
-			fmt.Fprintf(out, ws(depth)+"[]")
+			fmt.Fprintf(out, "%s[]", ws(depth))
 		} else {
 			fmt.Fprintln(out, ws(depth)+"[")
 			for i := 0; ; i++ {

core/rawdb/accessors_chain_test.go

@@ -391,7 +391,7 @@ func TestBlockReceiptStorage(t *testing.T) {
 		t.Fatalf("no receipts returned")
 	} else {
 		if err := checkReceiptsRLP(rs, receipts); err != nil {
-			t.Fatalf(err.Error())
+			t.Fatalf("%s", err.Error())
 		}
 	}
 	// Delete the body and ensure that the receipts are no longer returned (metadata can't be recomputed)
@@ -401,7 +401,7 @@ func TestBlockReceiptStorage(t *testing.T) {
 	}
 	// Ensure that receipts without metadata can be returned without the block body too
 	if err := checkReceiptsRLP(ReadRawReceipts(db, hash, 0), receipts); err != nil {
-		t.Fatalf(err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	// Sanity check that body alone without the receipt is a full purge
 	WriteBody(db, hash, 0, body)

crypto/kzg4844/kzg4844_gokzg.go

@@ -49,7 +49,7 @@ func gokzgInit() {
 func gokzgBlobToCommitment(blob Blob) (Commitment, error) {
 	gokzgIniter.Do(gokzgInit)
 
-	commitment, err := context.BlobToKZGCommitment((gokzg4844.Blob)(blob), 0)
+	commitment, err := context.BlobToKZGCommitment((*gokzg4844.Blob)(&blob), 0)
 	if err != nil {
 		return Commitment{}, err
 	}
@@ -61,7 +61,7 @@ func gokzgBlobToCommitment(blob Blob) (Commitment, error) {
 func gokzgComputeProof(blob Blob, point Point) (Proof, Claim, error) {
 	gokzgIniter.Do(gokzgInit)
 
-	proof, claim, err := context.ComputeKZGProof((gokzg4844.Blob)(blob), (gokzg4844.Scalar)(point), 0)
+	proof, claim, err := context.ComputeKZGProof((*gokzg4844.Blob)(&blob), (gokzg4844.Scalar)(point), 0)
 	if err != nil {
 		return Proof{}, Claim{}, err
 	}
@@ -83,7 +83,7 @@ func gokzgVerifyProof(commitment Commitment, point Point, claim Claim, proof Pro
 func gokzgComputeBlobProof(blob Blob, commitment Commitment) (Proof, error) {
 	gokzgIniter.Do(gokzgInit)
 
-	proof, err := context.ComputeBlobKZGProof((gokzg4844.Blob)(blob), (gokzg4844.KZGCommitment)(commitment), 0)
+	proof, err := context.ComputeBlobKZGProof((*gokzg4844.Blob)(&blob), (gokzg4844.KZGCommitment)(commitment), 0)
 	if err != nil {
 		return Proof{}, err
 	}
@@ -94,5 +94,5 @@ func gokzgComputeBlobProof(blob Blob, commitment Commitment) (Proof, error) {
 func gokzgVerifyBlobProof(blob Blob, commitment Commitment, proof Proof) error {
 	gokzgIniter.Do(gokzgInit)
 
-	return context.VerifyBlobKZGProof((gokzg4844.Blob)(blob), (gokzg4844.KZGCommitment)(commitment), (gokzg4844.KZGProof)(proof))
+	return context.VerifyBlobKZGProof((*gokzg4844.Blob)(&blob), (gokzg4844.KZGCommitment)(commitment), (gokzg4844.KZGProof)(proof))
 }