Merge pull request #971 from nspcc-dev/add-key-size-checks-2.x

Add key size checks 2.x

pkg/core/interop_system.go

@@ -322,6 +322,10 @@ func (ic *interopContext) runtimeCheckWitness(v *vm.VM) error {
 	hashOrKey := v.Estack().Pop().Bytes()
 	hash, err := util.Uint160DecodeBytesBE(hashOrKey)
 	if err != nil {
+		// We only accept compressed keys here as per C# implementation.
+		if len(hashOrKey) != 33 {
+			return errors.New("bad parameter length")
+		}
 		key := &keys.PublicKey{}
 		err = key.DecodeBytes(hashOrKey)
 		if err != nil {

pkg/crypto/keys/publickey.go

@@ -158,6 +158,12 @@ func decodeCompressedY(x *big.Int, ylsb uint) (*big.Int, error) {
 
 // DecodeBytes decodes a PublicKey from the given slice of bytes.
 func (p *PublicKey) DecodeBytes(data []byte) error {
+	l := len(data)
+	if !((l == 1 && data[0] == 0) ||
+		(l == 33 && (data[0] == 0x02 || data[0] == 0x03)) ||
+		(l == 65 && data[0] == 0x04)) {
+		return errors.New("invalid key size/prefix")
+	}
 	b := io.NewBinReaderFromBuf(data)
 	p.DecodeBinary(b)
 	return b.Err
@@ -288,7 +294,7 @@ func (p *PublicKey) UnmarshalJSON(data []byte) error {
 		return errors.New("wrong format")
 	}
 
-	bytes := make([]byte, l-2)
+	bytes := make([]byte, hex.DecodedLen(l-2))
 	_, err := hex.Decode(bytes, data[1:l-1])
 	if err != nil {
 		return err

pkg/crypto/keys/publickey_test.go

@@ -91,6 +91,12 @@ func TestDecodeBytes(t *testing.T) {
 	require.Equal(t, pubKey, decodedPubKey)
 }
 
+func TestDecodeBytesBadInfinity(t *testing.T) {
+	decodedPubKey := &PublicKey{}
+	err := decodedPubKey.DecodeBytes([]byte{0, 0, 0})
+	require.Error(t, err)
+}
+
 func TestSort(t *testing.T) {
 	pubs1 := make(PublicKeys, 10)
 	for i := range pubs1 {