Skip to content

Reject truncated RLP and trailing data when decoding - #32

Merged
sc0Vu merged 1 commit into
web3p:masterfrom
sc0Vuai:fix/decode-truncation-trailing
Sep 23, 2026
Merged

sc0Vu merged 1 commit into
web3p:masterfrom
sc0Vuai:fix/decode-truncation-trailing

Conversation

@sc0Vuai

@sc0Vuai sc0Vuai commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

The decoder silently accepted malformed input:

  • items shorter than their declared length: 0x83646f → "646f", 0xc3 → []
  • a child longer than its parent list: 0xc2836400 → ["64"]
  • extra bytes after the top-level item: 0x0102 → "01"

Each case now throws a RuntimeException, as ethers.js does. Every item's size is checked against the available data, and decode() rejects anything left after the top-level item.

Behavior change: input that used to decode silently now throws. That includes odd-length hex such as 0x123, which was padded and partly ignored. Correct RLP decodes the same as before.

Adds 19 regression vectors for truncated and trailing input.

🤖 Generated with Claude Code (https://claude.com/claude-code)

The decoder silently accepted items shorter than their declared length
(e.g. 0x83646f -> "646f", 0xc3 -> []), children that overran their
parent list (0xc2836400 -> ["64"]), and ignored bytes after the
top-level item (0x0102 -> "01").

Check the available length in the short string, long string and short
list branches (the long list branch already did), and throw when data
remains after the top-level item.

Add regression vectors for truncated and trailing input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sc0Vu
sc0Vu merged commit a22b1ba into web3p:master Sep 23, 2026
3 checks passed
@codecov

codecov Bot commented Sep 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.27%. Comparing base (9d6e61b) to head (77ea176).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff              @@
##             master      #32      +/-   ##
============================================
+ Coverage     82.11%   84.27%   +2.15%     
- Complexity       55       59       +4     
============================================
  Files             3        3              
  Lines           151      159       +8     
============================================
+ Hits            124      134      +10     
+ Misses           27       25       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants