orneryd / NornicDB / 30914030025

89%

Build Type

push

github

Committed by orneryd

Commit Message

fix(bolt): reject oversized PackStream list declarations

Validate LIST8, LIST16, and LIST32 element counts against the remaining
payload before allocating the decoded slice. This prevents unauthenticated
LIST32 headers from triggering attacker-controlled memory allocation during
Bolt HELLO decoding.

Add direct and nested-map regression coverage for a LIST32 count of
0xFFFFFFFF.

Coverage Stats

12 of 12 new or added lines in 1 file covered. (100.0%)

16 existing lines in 7 files now uncovered.

148031 of 166113 relevant lines covered (89.11%)

1.04 hits per line