fix: reject oversized envelopes at decode (#72)

package.json

@@ -7,27 +7,27 @@
     "@noble/ciphers": "^2.2.0",
     "@noble/curves": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "expo": "~57.0.7",
-    "expo-build-properties": "~57.0.6",
+    "expo": "~57.0.8",
+    "expo-build-properties": "~57.0.7",
     "expo-camera": "~57.0.3",
     "expo-clipboard": "~57.0.1",
     "expo-constants": "~57.0.6",
     "expo-crypto": "~57.0.1",
-    "expo-dev-client": "~57.0.7",
+    "expo-dev-client": "~57.0.8",
     "expo-device": "~57.0.1",
     "expo-font": "~57.0.1",
     "expo-glass-effect": "~57.0.1",
     "expo-image": "~57.0.1",
-    "expo-linking": "~57.0.3",
+    "expo-linking": "~57.0.4",
     "expo-localization": "~57.0.1",
-    "expo-router": "~57.0.7",
+    "expo-router": "~57.0.8",
     "expo-secure-store": "~57.0.1",
-    "expo-splash-screen": "~57.0.4",
+    "expo-splash-screen": "~57.0.5",
     "expo-sqlite": "~57.0.1",
     "expo-status-bar": "~57.0.1",
     "expo-symbols": "~57.0.1",
     "expo-system-ui": "~57.0.1",
-    "expo-web-browser": "~57.0.1",
+    "expo-web-browser": "~57.0.2",
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "react-native": "0.86.0",
@@ -37,7 +37,7 @@
     "react-native-qrcode-svg": "^6.3.21",
     "react-native-reanimated": "4.5.0",
     "react-native-safe-area-context": "~5.7.0",
-    "react-native-screens": "4.25.2",
+    "react-native-screens": "~4.26.0",
     "react-native-svg": "15.15.4",
     "react-native-web": "~0.21.0",
     "react-native-worklets": "0.10.0"

src/lib/__tests__/protocol.test.ts

@@ -15,6 +15,7 @@ import {
   DEFAULTS,
   EnvelopeType,
   HEADER_LEN,
+  MAX_ENVELOPE_LEN,
   MAX_HOPS,
   PROTOCOL_VERSION,
   TIME_GRANULARITY_MS,
@@ -130,6 +131,30 @@ describe('envelope decoding is hostile-input safe', () => {
     assert.throws(() => encodeEnvelope(sample({ payload: new Uint8Array(40_000) })));
   });
 
+  it('rejects a payload above the encode cap but under the native BLE reassembly cap (#72)', () => {
+    // Native layers reassemble up to 32 KiB; encode refuses above MAX_ENVELOPE_LEN.
+    // Craft a well-formed header whose payloadLen sits in that gap.
+    const payloadLen = MAX_ENVELOPE_LEN - HEADER_LEN + 1;
+    assert.ok(HEADER_LEN + payloadLen <= 32_768, 'fixture must fit under native cap');
+
+    const raw = new Uint8Array(HEADER_LEN + payloadLen);
+    raw[0] = 0x50;
+    raw[1] = 0x43;
+    raw[2] = PROTOCOL_VERSION;
+    raw[3] = EnvelopeType.Sealed;
+    raw.fill(9, 4, 20);
+    const view = new DataView(raw.buffer);
+    const t = Math.floor(1_700_000_040_000 / TIME_GRANULARITY_MS) * TIME_GRANULARITY_MS;
+    view.setUint16(20, Math.floor(t / 0x100000000));
+    view.setUint32(22, t % 0x100000000);
+    view.setUint32(26, DEFAULTS.ttlSeconds);
+    raw[30] = 0;
+    raw[31] = DEFAULTS.maxHops;
+    view.setUint16(32, payloadLen);
+
+    assert.equal(decodeEnvelope(raw), null);
+  });
+
   it('refuses to encode a wrong-length id', () => {
     assert.throws(() => encodeEnvelope(sample({ id: new Uint8Array(8) })));
   });

src/lib/__tests__/store.test.ts

@@ -9,6 +9,14 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 
+import type { Envelope } from '../protocol';
+import {
+  DEFAULTS,
+  EnvelopeType,
+  HEADER_LEN,
+  MAX_ENVELOPE_LEN,
+  PROTOCOL_VERSION,
+} from '../protocol';
 import type { Message } from '../store';
 import { MESSAGE_RETENTION_MS, createMemoryStore } from '../store';
 
@@ -90,3 +98,21 @@ describe('message retention', () => {
     );
   });
 });
+
+describe('storeEnvelope size gate (#72)', () => {
+  it('swallows an oversized envelope instead of throwing', async () => {
+    const store = createMemoryStore();
+    const oversized: Envelope = {
+      version: PROTOCOL_VERSION,
+      type: EnvelopeType.Sealed,
+      id: new Uint8Array(16).fill(1),
+      createdAt: Date.now(),
+      ttlSeconds: DEFAULTS.ttlSeconds,
+      hopCount: 0,
+      maxHops: DEFAULTS.maxHops,
+      payload: new Uint8Array(MAX_ENVELOPE_LEN - HEADER_LEN + 1),
+    };
+    await assert.doesNotReject(() => store.storeEnvelope(oversized));
+    assert.equal(store.envelopes.length, 0);
+  });
+});

src/lib/db.ts

@@ -10,9 +10,9 @@
 
 import { fromBase64, toBase64 } from './bytes';
 import type { ReceiveKey, SignedReceiveKey } from './crypto-core';
 import { RECEIVE_KEY_RETENTION_MS } from './crypto-core';
 import type { PersistedOtk } from './prekeys';
 import { decodeSignedReceiveKey, encodeSignedReceiveKey } from './crypto-core';
 import type { Envelope } from './protocol';
 import { decodeEnvelope, encodeEnvelope } from './protocol';
 import type { MeshStore, Message, MessageState } from './store';
@@ -447,12 +447,20 @@
   const now = Date.now();
   const claimed = e.createdAt + e.ttlSeconds * 1000;
 
+  let raw: string;
+  try {
+    raw = toBase64(encodeEnvelope(e));
+  } catch {
+    // Oversized or malformed — refuse rather than throw into fire-and-forget ingest (#72).
+    return;
+  }
+
   await d.runAsync(
     `INSERT OR REPLACE INTO envelopes (id, raw, created_at, expires_at, hop_count, is_ours)
      VALUES (?, ?, ?, ?, ?, ?)`,
     [
       toBase64(e.id),
-      toBase64(encodeEnvelope(e)),
+      raw,
       e.createdAt,
       Math.min(claimed, now + MAX_LOCAL_RETENTION_MS),
       e.hopCount,

src/lib/mesh.ts

@@ -211,7 +211,10 @@ export class MeshEngine {
         this.servedToPeer.delete(id);
         this.emit();
       }),
-      this.transport.on('payload', (peerId, b64) => void this.ingest(peerId, b64)),
+      this.transport.on('payload', (peerId, b64) => {
+        // Hostile/malformed frames must not surface as unhandled rejections (#72).
+        void this.ingest(peerId, b64).catch(() => {});
+      }),
       this.transport.on('error', (message) => {
         // An empty message is the transport's "clear the error" signal, e.g. the
         // radio reaching 'ready' after a transient startup state.

src/lib/protocol.ts

@@ -59,7 +59,7 @@
   Request: 3,
 } as const;
 
 export type EnvelopeType = (typeof EnvelopeType)[keyof typeof EnvelopeType];
 
 export type Envelope = {
   version: number;
@@ -120,6 +120,10 @@
 
   const view = new DataView(raw.buffer, raw.byteOffset, raw.byteLength);
   const payloadLen = view.getUint16(32);
+  // Same ceiling encodeEnvelope enforces. Native BLE reassembles up to 32 KiB,
+  // so without this check an oversized payload decodes, burns trial-decrypt,
+  // then throws in storeEnvelope as an unhandled rejection (#72).
+  if (payloadLen > MAX_ENVELOPE_LEN - HEADER_LEN) return null;
   if (raw.length !== HEADER_LEN + payloadLen) return null;
 
   const createdAt = view.getUint16(20) * 0x100000000 + view.getUint32(22);

src/lib/store.ts

@@ -199,9 +199,16 @@ export function createMemoryStore(now: () => number = Date.now): MemoryStore {
       const t = now();
       const claimed = e.createdAt + e.ttlSeconds * 1000;
       const id = toBase64(e.id);
+      let raw: string;
+      try {
+        raw = toBase64(encodeEnvelope(e));
+      } catch {
+        // Match db.ts: refuse oversized envelopes without throwing (#72).
+        return;
+      }
       envelopes.set(id, {
         id,
-        raw: toBase64(encodeEnvelope(e)),
+        raw,
         createdAt: e.createdAt,
         // Same first-sight cap as db.ts: a peer that inflates ttlSeconds must
         // not be able to make us hoard its traffic.