CCIP-4710: Adding nil and length check on input value to Ed25519 veri…

…fy call
smartcontractkit · Dec 20, 2024 · 01dbd80 · 01dbd80
1 parent 428f005
commit 01dbd80
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/commit/merkleroot/rmn/crypto.go b/commit/merkleroot/rmn/crypto.go
@@ -47,6 +47,12 @@ func verifyObservationSignature(
 	msg := append([]byte(signedObservationPrefix), observationBytesSha256[:]...)
 	msgSha256 := sha256.Sum256(msg)
 
+	if rmnNode.OffchainPublicKey == nil {
+		return fmt.Errorf("node %d has no offchain public key", rmnNode.ID)
+	}
+	if len(*rmnNode.OffchainPublicKey) != ed25519.PublicKeySize {
+		return fmt.Errorf("node %d has an invalid offchain public key", rmnNode.ID)
+	}
 	isValid := verifier.Verify(*rmnNode.OffchainPublicKey, msgSha256[:], signedObs.Signature)
 	if !isValid {
 		return fmt.Errorf("observation signature does not match node %d public key", rmnNode.ID)