Skip to content

fix reversed empty range in try_from_bytes - #11

Open
Zk-nd3r wants to merge 1 commit into
ShieldedLabs:s1_devfrom
Zk-nd3r:fix-reversed-empty-range-deserialize
Open

fix reversed empty range in try_from_bytes#11
Zk-nd3r wants to merge 1 commit into
ShieldedLabs:s1_devfrom
Zk-nd3r:fix-reversed-empty-range-deserialize

Conversation

@Zk-nd3r

@Zk-nd3r Zk-nd3r commented Apr 12, 2026

Copy link
Copy Markdown
Contributor

bytes[76 - 32..2] is bytes[44..2], a reversed range. The 46-byte length guard above (if bytes.len() < 76 - 32 + 2) and the 2-byte length field that follows the 44-byte vote header point at bytes[76 - 32..76 - 32 + 2].

Same copy-paste at 4 sites, all suppressing clippy::reversed_empty_ranges:

  • tenderlink/src/lib.rs
  • zebra-crosslink/zebra-crosslink/src/malctx.rs
  • zebra-crosslink/zebra-crosslink/src/lib.rs
  • zebra-crosslink/zebra-chain/src/block/header.rs

No callers of these functions in tree right now so this is latent. Anything that wires them up later crashes on the first decode. Fixed the range and dropped the allow at all 4 sites.

bytes[76 - 32..2] is bytes[44..2], a reversed range that panics on the
first decode. The length guard above admits any input of 46 bytes or
more, and the 2-byte signature-count field that follows the 44-byte vote
header lives at bytes[44..46].

Fix the range and drop the clippy::reversed_empty_ranges allow that was
hiding it.
@Zk-nd3r
Zk-nd3r changed the base branch from main to s1_dev July 29, 2026 18:45
@Zk-nd3r
Zk-nd3r force-pushed the fix-reversed-empty-range-deserialize branch from 9d4ad5b to 59552e3 Compare July 29, 2026 18:45
@Zk-nd3r

Zk-nd3r commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Retargeted to s1_dev and rebased. The bug survived the consolidation that collapsed the four duplicate try_from_bytes copies into one: librustzcash/zcash_primitives/src/bft.rs:694 still reads bytes[76 - 32..2], so the same reversed range is live on current s1_dev and this is now a one-line change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant