hiero-ledger / hiero-ledger/hiero-consensus-node

Generated codecs use assert on tags from untrusted input

Open
#26,321 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
406
Forks
226
Avg merge
3d 4h
Merged PRs (30d)
210

Description

I was having a go at fuzzing... note i was having a go ...?

Not production impact-

Generated protobuf codecs validate a tag read from untrusted input using assert. Example in CryptoUpdateTransactionBodyProtoCodec (generated), parsing a nested wrapper-value field:

```
final int valueFieldTag = input.readVarInt(false); // from untrusted input
assert (valueFieldTag >>> TAG_FIELD_OFFSET) == 1;
assert (valueFieldTag & TAG_WIRE_TYPE_MASK) == 0;
```

Observed behavior — a crafted 151-byte input to TransactionBody.PROTOBUF.parse(...):

With assertions enabled (-ea): throws java.lang.AssertionError.
With assertions disabled (default): the input is rejected cleanly as ParseException.

Under -da (production default) there's no impact — the input is cleanly rejected. But any context that runs the parser with -ea (unit tests, CI, some staging setups) will see an AssertionError

Is the -ea behaviour fine, or should tag checks on parsed input surface as a ParseException regardless

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the 151-byte case through TransactionBody.PROTOBUF.parse(...) with assertions enabled and disabled. Inspect the generated CryptoUpdateTransactionBodyProtoCodec path that reads valueFieldTag and compare its AssertionError and ParseException behavior. Done means the chosen handling for tags from untrusted input is consistent and covered by an appropriate parser test.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.