ChainSafe / ChainSafe/ssz

Container SSZ deserialize on short/empty inputs throws RangeError

Open
#502 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
61
Forks
26
Avg merge
3h 20m
Merged PRs (30d)
6

Description

**Describe the bug**

When deserializing empty/short SSZ buffers for container types on the latest fork (electra), @chainsafe/ssz throws a raw RangeError from DataView (e.g., Attestation, AttesterSlashing, BeaconBlock) instead of a typed decode error. This was found via fuzzing Lodestar.

**Expected behavior**

Detect invalid/short input and throw a stable, typed decode error (not a DataView RangeError).

**Steps to Reproduce**

- Empty BeaconBlock:
```bash
node -e "(async()=>{const {ssz}=await import('@lodestar/types/electra');
ssz.BeaconBlock.deserialize(Buffer.from('','hex'));})()"
```

- Short BeaconBlock:

```bash
node -e "(async()=>{const {ssz}=await import('@lodestar/types/electra');
ssz.BeaconBlock.deserialize(Buffer.from('64000000a8ea7673','hex'));})()"
```

- Short Attestation:
```bash
node -e "(async()=>{const {ssz}=await import('@lodestar/types/electra');
ssz.Attestation.deserialize(Buffer.from('04ff','hex'));})()"
```

- Short AttesterSlashing:
```bash
node -e "(async()=>{const {ssz}=await import('@lodestar/types/electra');
ssz.AttesterSlashing.deserialize(Buffer.from('01ff','hex'));})()"
```

- Observed (common):
```
RangeError: Offset is outside the bounds of the DataView
at DataView.prototype.getUint32 ()
at readVariableOffsets (.../node_modules/@chainsafe/ssz/lib/type/container.js:341:29)
at ContainerType.getFieldRanges (.../node_modules/@chainsafe/ssz/lib/type/container.js:310:25)
at ContainerType.value_deserializeFromBytes (file:///Users/hanzhi/node_modules/@chainsafe/ssz/lib/type/container.js:145:34)
at ContainerType.deserialize (.../node_modules/@chainsafe/ssz/lib/type/abstract.js:42:21)
at [eval]:2:19
```

**Desktop:**

- OS: Ubuntu 22.04
- Version: Node v20.x; @lodestar/types 1.34.1; @chainsafe/ssz 1.2.2
- Branch: ssz-v1.2.2
- Commit hash: 7f5580c2ea69f9307300ddb6010a8bc7ce2fc471

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the ContainerType.deserialize and value_deserializeFromBytes entry points in lib/type/container.js, focusing on getFieldRanges and readVariableOffsets shown in the stack trace. Run the empty and short BeaconBlock, Attestation, and AttesterSlashing examples; done means invalid short input produces a stable typed decode error instead of a DataView RangeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.