From 63a099e1d3a8dfb253bff6d8bfbb07db2dd22b9b Mon Sep 17 00:00:00 2001 From: Adequate Limited Date: Sun, 5 Apr 2026 22:45:48 -0400 Subject: [PATCH] fix(network): reject oversized peer list responses in get_ipl() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #107 A peer responding to OP_GET_IPL could send up to 65535 bytes of IP data (word16 len field). The consumer loop in scan_quorum() is bounded by netplistidx < 1024, but the excess data still causes unnecessary iteration. Added a check rejecting responses where len exceeds RPLISTLEN * sizeof(word32) — the maximum a legitimate node would ever send. Added TODO noting that received peer IPs should be treated as unverified candidates rather than trusted immediately. --- src/network.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/network.c b/src/network.c index 78a3659..cb3a5ed 100644 --- a/src/network.c +++ b/src/network.c @@ -748,10 +748,18 @@ int get_ipl(NODE *np, word32 ip) /* send OP_GET_IPL and receive single packet response */ ecode = send_op(np, OP_GET_IPL); if (ecode == VEOK) ecode = recv_tx(np, STD_TIMEOUT); + /* reject oversized peer lists (DoS mitigation) */ + if (ecode == VEOK + && get16(np->tx.len) > RPLISTLEN * sizeof(word32)) { + ecode = VEBAD; + } /* cleanup */ sock_close(np->sd); np->sd = INVALID_SOCKET; } + /* TODO: received peer IPs should be treated as unverified candidates + * until confirmed as real nodes, rather than added directly to the + * scan/recent peer lists. See: https://github.com/mochimodev/mochimo/issues/107 */ return ecode; } /* end get_ipl() */