Skip to content
This repository was archived by the owner on Mar 11, 2025. It is now read-only.

Commit 22faa05

Browse files
authored
check that unpack is tolerant of small sizes (#3416)
1 parent c986098 commit 22faa05

File tree

1 file changed

+23
-0
lines changed

1 file changed

+23
-0
lines changed

token/program/src/instruction.rs

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,9 @@ impl<'a> TokenInstruction<'a> {
519519
10 => Self::FreezeAccount,
520520
11 => Self::ThawAccount,
521521
12 => {
522+
if rest.len() < 8 {
523+
return Err(TokenError::InvalidInstruction.into());
524+
}
522525
let (amount, rest) = rest.split_at(8);
523526
let amount = amount
524527
.try_into()
@@ -530,6 +533,9 @@ impl<'a> TokenInstruction<'a> {
530533
Self::TransferChecked { amount, decimals }
531534
}
532535
13 => {
536+
if rest.len() < 8 {
537+
return Err(TokenError::InvalidInstruction.into());
538+
}
533539
let (amount, rest) = rest.split_at(8);
534540
let amount = amount
535541
.try_into()
@@ -541,6 +547,9 @@ impl<'a> TokenInstruction<'a> {
541547
Self::ApproveChecked { amount, decimals }
542548
}
543549
14 => {
550+
if rest.len() < 8 {
551+
return Err(TokenError::InvalidInstruction.into());
552+
}
544553
let (amount, rest) = rest.split_at(8);
545554
let amount = amount
546555
.try_into()
@@ -552,6 +561,9 @@ impl<'a> TokenInstruction<'a> {
552561
Self::MintToChecked { amount, decimals }
553562
}
554563
15 => {
564+
if rest.len() < 8 {
565+
return Err(TokenError::InvalidInstruction.into());
566+
}
555567
let (amount, rest) = rest.split_at(8);
556568
let amount = amount
557569
.try_into()
@@ -588,6 +600,9 @@ impl<'a> TokenInstruction<'a> {
588600
21 => Self::GetAccountDataSize,
589601
22 => Self::InitializeImmutableOwner,
590602
23 => {
603+
if rest.len() < 8 {
604+
return Err(TokenError::InvalidInstruction.into());
605+
}
591606
let (amount, _rest) = rest.split_at(8);
592607
let amount = amount
593608
.try_into()
@@ -1689,4 +1704,12 @@ mod test {
16891704
let unpacked = TokenInstruction::unpack(&expect).unwrap();
16901705
assert_eq!(unpacked, check);
16911706
}
1707+
1708+
#[test]
1709+
fn test_instruction_unpack_panic() {
1710+
for i in 0..255u8 {
1711+
let expect = Vec::from([i, 1, 0, 0, 0, 0, 0, 0, 0, 2]);
1712+
_ = TokenInstruction::unpack(&expect[0..2]);
1713+
}
1714+
}
16921715
}

0 commit comments

Comments
 (0)