Skip to content

Conversation

@bennyhodl
Copy link
Owner

No description provided.

oracle_public_key: crate::ser_impls::read_schnorr_pubkey(reader)?,
signatures: {
let len: u16 = Readable::read(reader)?;
let mut signatures = Vec::with_capacity(len as usize);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No validation on len before allocating capacity?

impl Readable for OracleAnnouncement {
fn read<R: bitcoin::io::Read>(reader: &mut R) -> Result<Self, DecodeError> {
let _type_id: u64 = BigSize::read(reader)?.0;
let _length: u64 = BigSize::read(reader)?.0;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On lines 252, 257, 502 the _length field is read but never validated?

Comment on lines +256 to +257
let _type_id: u64 = BigSize::read(reader)?.0;
let _length: u64 = BigSize::read(reader)?.0;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is TLV header read twice?

Comment on lines +284 to +287
let event_size = self.oracle_event.serialized_length();
BigSize(self.oracle_event.type_id() as u64).serialized_length() +
BigSize(event_size as u64).serialized_length() +
event_size
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Calculating the size manually could lead to buffer overflows.

let mut cursor = Cursor::new(bytes);
let announcement = OracleAnnouncement::read(&mut cursor);
println!("{:?}", announcement);
assert!(announcement.is_ok())
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add validation on whether the parsed content matches the expected values?

Comment on lines +227 to +238
// fn read_oracle_message<T: Readable>(msg: MagnoliaResponse) -> Result<T, Error> {
// let bytes = hex::decode(msg.hex).map_err(|e| Error::OracleError(e.to_string()))?;
// let mut cursor = Cursor::new(bytes);
// let _type_id: u64 = lightning::util::ser::BigSize::read(&mut cursor).unwrap().0;
// let _length: u64 = lightning::util::ser::BigSize::read(&mut cursor).unwrap().0;
// T::read(&mut cursor).map_err(|e| Error::OracleError(e.to_string()))
// }
// impl_dlc_writeable!(OracleAnnouncement, {
// (announcement_signature, {cb_writeable, write_schnorrsig, read_schnorrsig}),
// (oracle_public_key, {cb_writeable, write_schnorr_pubkey, read_schnorr_pubkey}),
// (oracle_event, {cb_writeable, write_as_tlv, read_as_tlv})
// });
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this worth keeping commented out versus deleting entirely?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants