IPFS go-bitfield vulnerable to DoS via malformed size arguments

When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics.

This happen when the size is a not a multiple of 8 or is negative.
There were already a note in the NewBitfield documentation:

Panics if size is not a multiple of 8.

But it incomplete and missing from FromBytes's documentation.

This has been replaced by returning an (Bitfield, error) and returning a non nil error if the size is wrong.

Ensure size%8 == 0 && size >= 0 yourself before calling NewBitfield or FromBytes

Jorropo published to ipfs/go-bitfield Feb 9, 2023

Published by the National Vulnerability Database Feb 9, 2023

Published to the GitHub Advisory Database Feb 10, 2023

Reviewed Feb 10, 2023

Last updated Jun 13, 2023

Provide feedback