ARCHIVE/rippled
1
0
Fork 0
mirror of https://github.com/XRPLF/rippled.git synced 2026-09-26 23:19:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Check zero object id in SponsorshipTransfer preflight (#8254)

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
yinyiqian1
2026-09-22 17:02:59 +00:00
committed by GitHub
parent 00606bec1a
commit 0219c01b33
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
View File

@@ -2,6 +2,7 @@
#include <xrpl/basics/Log.h>
#include <xrpl/basics/base_uint.h>
#include <xrpl/beast/utility/Zero.h>
#include <xrpl/beast/utility/instrumentation.h>
#include <xrpl/core/ServiceRegistry.h>
#include <xrpl/ledger/ApplyView.h>
@@ -206,6 +207,13 @@ SponsorshipTransfer::preflight(PreflightContext const& ctx)
return temMALFORMED;
}
if (auto const objectID = ctx.tx[~sfObjectID];
ctx.rules.enabled(fixCleanup3_5_0) && objectID && *objectID == beast::kZero)
{
JLOG(ctx.j.debug()) << "preflight: sfObjectID must not be zero";
return temMALFORMED;
}
return tesSUCCESS;
}

19
src/test/app/Sponsor_test.cpp
View File

@@ -1163,6 +1163,25 @@ public:
sponsor::SponseeAcc(alice),
Ter(temMALFORMED));
}
// Post-fixCleanup3_5_0, a zero ObjectID is malformed.
// Pre-fixCleanup3_5_0 path is unreachable so it is not testable.
if (features[fixCleanup3_5_0])
{
uint256 const zeroObjectID{};
env(sponsor::transfer(alice, tfSponsorshipEnd, zeroObjectID), Ter(temMALFORMED));
env(sponsor::transfer(alice, tfSponsorshipCreate, zeroObjectID),
sponsor::As(sponsor, spfSponsorReserve),
Sig(sfSponsorSignature, sponsor),
Ter(temMALFORMED));
env(sponsor::transfer(alice, tfSponsorshipReassign, zeroObjectID),
sponsor::As(sponsor, spfSponsorReserve),
Sig(sfSponsorSignature, sponsor),
Ter(temMALFORMED));
}
}
{