path: Add length check to TLV payload decoding

decred · Jun 19, 2024 · f9ed030 · f9ed030
1 parent 9906aa0
commit f9ed030
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/path.go b/path.go
@@ -6,6 +6,7 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
+	"math"
 
 	"github.com/decred/dcrd/dcrec/secp256k1/v4"
 	"github.com/decred/dcrd/wire"
@@ -261,6 +262,10 @@ func (hp *HopPayload) Decode(r io.Reader) error {
 		}
 
 		payloadSize = uint32(varInt)
+		if payloadSize > math.MaxUint16 {
+			return fmt.Errorf("payload size %d larger than max allowed %d",
+				payloadSize, math.MaxUint16)
+		}
 		hp.Type = PayloadTLV
 	}