fix(dpp): bound length-prefixed document field reads before allocating

Document deserialization read a varint length from the (untrusted) serialized bytes and immediately allocated a Vec of that size, for both variable-size string/byte-array fields and nested object payloads. A proved getDocuments response is decoded before its quorum signature is checked, so a self-consistent GroveDB proof carrying a document whose length prefix claims gigabytes made every client that verifies proofs (rs-sdk, wasm-sdk, and the Dash Core embedder) abort on allocation failure from ~70 bytes of input.

Both sites now check the declared length against the bytes remaining in the reader and reject with CorruptedSerialization before allocating. A regression test feeds a 2^62 length prefix to both the string and object arms.

Author: PastaPastaPasta

packages/rs-dpp/src/data_contract/document_type/property/mod.rs

@@ -645,6 +645,33 @@ impl DocumentPropertyType {
         }
     }
 
+    /// Reads exactly `len` bytes, refusing up front when the buffer does
+    /// not hold that many. The length comes from the (possibly untrusted)
+    /// serialized document itself, so it must never drive an allocation
+    /// before it has been checked against the bytes actually present.
+    fn read_exact_bounded(
+        buf: &mut BufReader<&[u8]>,
+        len: usize,
+        what: &str,
+    ) -> Result<Vec<u8>, DataContractError> {
+        // `BufReader<&[u8]>` advances the underlying slice as it refills, so
+        // the bytes still readable are whatever is buffered plus whatever the
+        // slice has left.
+        let remaining = buf.buffer().len() + buf.get_ref().len();
+        if len > remaining {
+            return Err(DataContractError::CorruptedSerialization(format!(
+                "{what} declares {len} bytes but only {remaining} remain in the serialized document"
+            )));
+        }
+        let mut value = vec![0u8; len];
+        buf.read_exact(&mut value).map_err(|_| {
+            DataContractError::CorruptedSerialization(format!(
+                "error reading {what} of length {len} from serialized document"
+            ))
+        })?;
+        Ok(value)
+    }
+
     fn read_varint_value(buf: &mut BufReader<&[u8]>) -> Result<Vec<u8>, DataContractError> {
         let bytes: usize = buf.read_varint().map_err(|_| {
             DataContractError::CorruptedSerialization(
@@ -654,14 +681,7 @@ impl DocumentPropertyType {
         if bytes == 0 {
             Ok(vec![])
         } else {
-            let mut value: Vec<u8> = vec![0u8; bytes];
-            buf.read_exact(&mut value).map_err(|_| {
-                DataContractError::CorruptedSerialization(format!(
-                    "error reading varint of length {} from serialized document",
-                    bytes
-                ))
-            })?;
-            Ok(value)
+            Self::read_exact_bounded(buf, bytes, "varint value")
         }
     }
 
@@ -834,12 +854,7 @@ impl DocumentPropertyType {
                         "error reading varint of object length".to_string(),
                     )
                 })?;
-                let mut object_bytes = vec![0u8; object_byte_len];
-                buf.read_exact(&mut object_bytes).map_err(|_| {
-                    DataContractError::CorruptedSerialization(
-                        "error reading object bytes".to_string(),
-                    )
-                })?;
+                let object_bytes = Self::read_exact_bounded(buf, object_byte_len, "object")?;
                 // Wrap the bytes in a BufReader
                 let mut object_buf_reader = BufReader::new(&object_bytes[..]);
                 let mut finished_buffer = false;
@@ -4239,6 +4254,42 @@ mod tests {
     // read_optionally_from() tests
     // -----------------------------------------------------------------------
 
+    /// A serialized document is untrusted input: a length prefix must never
+    /// size an allocation before it has been checked against the bytes that
+    /// are actually present. Before this check a two-byte string field
+    /// declaring a multi-gigabyte length aborted the process on allocation.
+    #[test]
+    fn test_read_optionally_from_rejects_length_prefix_longer_than_input() {
+        use std::io::BufReader;
+        let prop = DocumentPropertyType::String(StringPropertySizes {
+            min_length: None,
+            max_length: None,
+        });
+        // varint 2^62 followed by two bytes of payload
+        let mut data = vec![0xffu8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f];
+        data.extend_from_slice(b"ab");
+        let mut reader = BufReader::new(data.as_slice());
+        let err = prop
+            .read_optionally_from(&mut reader, true)
+            .expect_err("oversized length prefix must be rejected, not allocated");
+        assert!(
+            err.to_string()
+                .contains("remain in the serialized document"),
+            "unexpected error: {err}"
+        );
+
+        let object = DocumentPropertyType::Object(IndexMap::new());
+        let mut reader = BufReader::new(data.as_slice());
+        let err = object
+            .read_optionally_from(&mut reader, true)
+            .expect_err("oversized object length must be rejected, not allocated");
+        assert!(
+            err.to_string()
+                .contains("remain in the serialized document"),
+            "unexpected error: {err}"
+        );
+    }
+
     #[test]
     fn test_read_optionally_from_optional_marker_none() {
         use std::io::BufReader;