feat(types-codec): Add maximum depth limit in decodeU8a functions (#6168)

* feat(decodeU8a): add maximum depth check for complex types in decode functions

* chore: lint

Author: rajk93

packages/types-codec/src/utils/decodeU8a.ts

@@ -5,6 +5,15 @@ import type { Codec, CodecClass, Registry } from '../types/index.js';
 
 import { u8aToHex } from '@polkadot/util';
 
+const MAX_DEPTH = 1024;
+
+/** @internal */
+function isComplexType (Type: CodecClass): boolean {
+  const typeName = Type.name?.toLowerCase() || '';
+
+  return ['enum', 'hashmap', 'linkage', 'null', 'option', 'range', 'rangeinclusive', 'result', 'struct', 'tuple', 'vec', 'vecfixed'].includes(typeName);
+}
+
 /** @internal */
 function formatFailure (registry: Registry, fn: 'decodeU8a' | 'decodeU8aStruct' | 'decodeU8aVec', _result: unknown[], { message }: Error, u8a: Uint8Array, i: number, count: number, Type: CodecClass, key?: string): string {
   let type = '';
@@ -63,6 +72,10 @@ export function decodeU8aStruct (registry: Registry, result: [string, Codec][],
   let offset = 0;
   let i = 0;
 
+  if (count > MAX_DEPTH && isComplexType(Types[i])) {
+    throw new Error(`decodeU8aStruct: Maximum depth exceeded, received ${count} elements, limit ${MAX_DEPTH}`);
+  }
+
   try {
     while (i < count) {
       const value = new Types[i](registry, u8a.subarray(offset));
@@ -86,6 +99,11 @@ export function decodeU8aStruct (registry: Registry, result: [string, Codec][],
  */
 export function decodeU8aVec <T extends Codec = Codec> (registry: Registry, result: unknown[], u8a: Uint8Array, startAt: number, Type: CodecClass<T>): [number, number] {
   const count = result.length;
+
+  if (count > MAX_DEPTH && isComplexType(Type)) {
+    throw new Error(`decodeU8aVec: Maximum depth exceeded, received ${count} elements, limit ${MAX_DEPTH}`);
+  }
+
   let offset = startAt;
   let i = 0;