diff --git a/core/vm/lightclient/v2/lightclient.go b/core/vm/lightclient/v2/lightclient.go index d5de960750..e1814bfd2f 100644 --- a/core/vm/lightclient/v2/lightclient.go +++ b/core/vm/lightclient/v2/lightclient.go @@ -194,6 +194,11 @@ func DecodeLightBlockValidationInput(input []byte) (*ConsensusState, *types.Ligh } csLen := binary.BigEndian.Uint64(input[consensusStateLengthBytesLength-uint64TypeLength : consensusStateLengthBytesLength]) + + if consensusStateLengthBytesLength+csLen < consensusStateLengthBytesLength { + return nil, nil, fmt.Errorf("integer overflow, csLen: %d", csLen) + } + if uint64(len(input)) <= consensusStateLengthBytesLength+csLen { return nil, nil, fmt.Errorf("expected payload size %d, actual size: %d", consensusStateLengthBytesLength+csLen, len(input)) }