diff options
| author | moneromooo-monero <moneromooo-monero@users.noreply.github.com> | 2018-02-02 16:50:35 +0000 |
|---|---|---|
| committer | moneromooo-monero <moneromooo-monero@users.noreply.github.com> | 2018-02-02 17:10:13 +0000 |
| commit | 61defd89e3f88f30d6a9fd9ba546c3317b61377e (patch) | |
| tree | 29e926494960d9506f7f066ef54711a3c8fed3b4 | |
| parent | ringct: fix infinite loop in unused h2b function (diff) | |
| download | monero-61defd89e3f88f30d6a9fd9ba546c3317b61377e.tar.xz | |
blockchain: sanity check number of precomputed hash of hash blocks
Coverity 142951
| -rw-r--r-- | src/cryptonote_core/blockchain.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index 178479f3c..6203f313c 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -4343,8 +4343,13 @@ void Blockchain::load_compiled_in_block_hashes() { const unsigned char *p = get_blocks_dat_start(m_testnet); const uint32_t nblocks = *p | ((*(p+1))<<8) | ((*(p+2))<<16) | ((*(p+3))<<24); + if (nblocks > (std::numeric_limits<uint32_t>::max() - 4) / sizeof(hash)) + { + MERROR("Block hash data is too large"); + return; + } const size_t size_needed = 4 + nblocks * sizeof(crypto::hash); - if(nblocks > 0 && nblocks * HASH_OF_HASHES_STEP > m_db->height() && get_blocks_dat_size(m_testnet) >= size_needed) + if(nblocks > 0 && nblocks > (m_db->height() + HASH_OF_HASHES_STEP - 1) / HASH_OF_HASHES_STEP && get_blocks_dat_size(m_testnet) >= size_needed) { p += sizeof(uint32_t); m_blocks_hash_of_hashes.reserve(nblocks); |