mirror of
https://github.com/XRPLF/rippled.git
synced 2025-12-06 17:27:55 +00:00
Address issues identified by external review:
* RIPD-1617, RIPD-1619, RIPD-1621:
Verify serialized public keys more strictly before
using them.
* RIPD-1618:
* Simplify the base58 decoder logic.
* Reduce the complexity of the base58 encoder and
eliminate a potential out-of-bounds memory access.
* Improve type safety by using an `enum class` to
enforce strict type checking for token types.
* RIPD-1616:
Avoid calling `memcpy` with a null pointer even if the
size is specified as zero, since it results in undefined
behavior.
Acknowledgements:
Ripple thanks Guido Vranken for responsibly disclosing these
issues.
Bug Bounties and Responsible Disclosures:
We welcome reviews of the rippled code and urge researchers
to responsibly disclose any issues that they may find. For
more on Ripple's Bug Bounty program, please visit:
https://ripple.com/bug-bounty
This commit is contained in:
@@ -85,8 +85,7 @@ template <>
|
||||
boost::optional<Seed>
|
||||
parseBase58 (std::string const& s)
|
||||
{
|
||||
auto const result = decodeBase58Token(
|
||||
s, TokenType::TOKEN_FAMILY_SEED);
|
||||
auto const result = decodeBase58Token(s, TokenType::FamilySeed);
|
||||
if (result.empty())
|
||||
return boost::none;
|
||||
if (result.size() != 16)
|
||||
@@ -101,10 +100,10 @@ parseGenericSeed (std::string const& str)
|
||||
return boost::none;
|
||||
|
||||
if (parseBase58<AccountID>(str) ||
|
||||
parseBase58<PublicKey>(TokenType::TOKEN_NODE_PUBLIC, str) ||
|
||||
parseBase58<PublicKey>(TokenType::TOKEN_ACCOUNT_PUBLIC, str) ||
|
||||
parseBase58<SecretKey>(TokenType::TOKEN_NODE_PRIVATE, str) ||
|
||||
parseBase58<SecretKey>(TokenType::TOKEN_ACCOUNT_SECRET, str))
|
||||
parseBase58<PublicKey>(TokenType::NodePublic, str) ||
|
||||
parseBase58<PublicKey>(TokenType::AccountPublic, str) ||
|
||||
parseBase58<SecretKey>(TokenType::NodePrivate, str) ||
|
||||
parseBase58<SecretKey>(TokenType::AccountSecret, str))
|
||||
{
|
||||
return boost::none;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user