fix: Upgrade to v0.3.8 and fix parsing security issues

- Upgrade to version 0.3.8
- Add data length validation to prevent out-of-bounds access
- Fix boundary check issues in all protocol parsers
This commit is contained in:
ysq
2025-08-22 17:58:57 +08:00
parent 92fd3ad5f4
commit e6912a8915
9 changed files with 52 additions and 10 deletions
@@ -31,6 +31,9 @@ pub struct AmmConfig {
pub const AMM_CONFIG_SIZE: usize = 1 + 2 + 32 + 4 * 2 + 2 + 4 * 2 + 32 + 8 * 3;
pub fn amm_config_decode(data: &[u8]) -> Option<AmmConfig> {
if data.len() < AMM_CONFIG_SIZE {
return None;
}
borsh::from_slice::<AmmConfig>(&data[..AMM_CONFIG_SIZE]).ok()
}
@@ -38,7 +41,7 @@ pub fn amm_config_parser(
account: &AccountPretty,
metadata: EventMetadata,
) -> Option<Box<dyn UnifiedEvent>> {
if account.data.len() < AMM_CONFIG_SIZE {
if account.data.len() < AMM_CONFIG_SIZE + 8 {
return None;
}
if let Some(amm_config) = amm_config_decode(&account.data[8..AMM_CONFIG_SIZE + 8]) {
@@ -116,6 +119,9 @@ pub struct PoolState {
pub const POOL_STATE_SIZE: usize = 1536;
pub fn pool_state_decode(data: &[u8]) -> Option<PoolState> {
if data.len() < POOL_STATE_SIZE {
return None;
}
borsh::from_slice::<PoolState>(&data[..POOL_STATE_SIZE]).ok()
}
@@ -123,7 +129,7 @@ pub fn pool_state_parser(
account: &AccountPretty,
metadata: EventMetadata,
) -> Option<Box<dyn UnifiedEvent>> {
if account.data.len() < POOL_STATE_SIZE {
if account.data.len() < POOL_STATE_SIZE + 8 {
return None;
}
if let Some(pool_state) = pool_state_decode(&account.data[8..POOL_STATE_SIZE + 8]) {
@@ -194,6 +200,9 @@ impl Default for TickArrayState {
pub const TICK_ARRAY_STATE_SIZE: usize = 10232;
pub fn tick_array_state_decode(data: &[u8]) -> Option<TickArrayState> {
if data.len() < TICK_ARRAY_STATE_SIZE {
return None;
}
borsh::from_slice::<TickArrayState>(&data[..TICK_ARRAY_STATE_SIZE]).ok()
}
@@ -201,7 +210,7 @@ pub fn tick_array_state_parser(
account: &AccountPretty,
metadata: EventMetadata,
) -> Option<Box<dyn UnifiedEvent>> {
if account.data.len() < TICK_ARRAY_STATE_SIZE {
if account.data.len() < TICK_ARRAY_STATE_SIZE + 8 {
return None;
}
if let Some(tick_array_state) =