hiero-ledger / hiero-ledger/hiero-consensus-node
Generated codecs use assert on tags from untrusted input
- Dominant language
- Java
- Stars
- 406
- Forks
- 226
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 210
Description
I was having a go at fuzzing... note i was having a go ...?
Not production impact-
Generated protobuf codecs validate a tag read from untrusted input using assert. Example in CryptoUpdateTransactionBodyProtoCodec (generated), parsing a nested wrapper-value field:
```
final int valueFieldTag = input.readVarInt(false); // from untrusted input
assert (valueFieldTag >>> TAG_FIELD_OFFSET) == 1;
assert (valueFieldTag & TAG_WIRE_TYPE_MASK) == 0;
```
Observed behavior — a crafted 151-byte input to TransactionBody.PROTOBUF.parse(...):
With assertions enabled (-ea): throws java.lang.AssertionError.
With assertions disabled (default): the input is rejected cleanly as ParseException.
Under -da (production default) there's no impact — the input is cleanly rejected. But any context that runs the parser with -ea (unit tests, CI, some staging setups) will see an AssertionError
Is the -ea behaviour fine, or should tag checks on parsed input surface as a ParseException regardless
Contributor guide
Research direction
Start by reproducing the 151-byte case through TransactionBody.PROTOBUF.parse(...) with assertions enabled and disabled. Inspect the generated CryptoUpdateTransactionBodyProtoCodec path that reads valueFieldTag and compare its AssertionError and ParseException behavior. Done means the chosen handling for tags from untrusted input is consistent and covered by an appropriate parser test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100