lnpeer: decode_short_ids: check length of short ids
What the developer wrote
Authored by f321x
lnpeer: decode_short_ids: check length of short ids
- if `encoded_short_ids` does not decode into a whole number of `short_channel_id`:
- MAY send a `warning`.
- MAY close the connection.
https://github.com/lightning/bolts/blob/0cf21511a781c295b9374aeaef37cf9c4d193502/07-routing-gossip.md?plain=1#L674
# Conflicts:
# electrum/lnpeer.py
What changed, and why it matters
This commit adds a length check to a function that decodes Lightning network channel identifiers from peer messages. Previously, if a peer sent a malformed list whose byte count was not a multiple of 8, the function would silently produce partial or misaligned identifiers. The change now rejects such inputs and may warn or disconnect the peer, following the Lightning protocol spec.
Treat as a hardening fix. Review whether the raised exception is caught cleanly by callers to avoid uncaught crashes, and ensure the warning/close behavior is implemented consistently with BOLT 7.
Security signals we found
Input validation added for peer-supplied length-sensitive data
Malformed gossip query could yield truncated or misaligned short_channel_id parsing
Spec-compliant handling (BOLT 7) for invalid encoded short ids
Potential for peer-triggered exception / connection close
Evidence from the diff
In electrum/lnpeer.py, decode_short_ids() now verifies that encoded_short_ids is at least one byte long and that the remaining bytes after the first byte are a multiple of 8 (the size of a short_channel_id). If not, it raises an exception. Previously only the first byte encoding type was checked. This aligns with BOLT 7 guidance to warn or close on invalid short-id encoding.
Changed components
electrum/lnpeer.py: Peer.decode_short_ids()Inspect captured patch +3 / −1
diff --git a/electrum/lnpeer.py b/electrum/lnpeer.py
index 98e3a29..55a591c 100644
--- a/electrum/lnpeer.py
+++ b/electrum/lnpeer.py
@@ -787,7 +787,9 @@ class Peer(Logger, EventListener):
@staticmethod
def decode_short_ids(encoded):
- if encoded[0] != 0:
+ if len(encoded) < 1 or (len(encoded) - 1) % 8 != 0:
+ raise Exception(f'decode_short_ids: invalid size: {len(encoded)=}')
+ elif encoded[0] != 0:
raise Exception(f'decode_short_ids: unexpected first byte: {encoded[0]}')
decoded = encoded[1:]
ids = [decoded[i:i+8] for i in range(0, len(decoded), 8)]
Why this scored 50/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.