Skip to content

fix: consume complete COSE unprotected header#65

Draft
leopoldjoy wants to merge 1 commit into
mainfrom
audit/parse-unprotected-cose-header
Draft

fix: consume complete COSE unprotected header#65
leopoldjoy wants to merge 1 commit into
mainfrom
audit/parse-unprotected-cose-header

Conversation

@leopoldjoy

Copy link
Copy Markdown
Contributor

Summary

  • advance past the complete unprotected CBOR map before reading payload and signature
  • reject truncated maps and trailing bytes after the COSE signature
  • cover empty and non-empty unprotected maps

Audit finding

Addresses external finding #7.

Tests

  • forge fmt --check
  • forge test (208 passed, 1 skipped)
  • forge build --sizes
  • NitroValidator runtime: 17,392 bytes

Co-authored-by: OpenCode <opencode-noreply@coinbase.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant