Refuse to set features at index higher than `u16::MAX` bytes
What the developer wrote
Authored by Matt Corallo
Refuse to set features at index higher than `u16::MAX` bytes
These aren't serialize-able and clearly bogus.
Reported by Project Loupe
What changed, and why it matters
This commit adds a safety check in the code that handles Lightning network feature flags. Feature flags are small on/off settings used when two nodes connect. The change prevents the code from accepting a feature flag position so high that it would require more than 65,535 bytes to store. Such huge positions cannot be serialized to the network format, so they are now rejected as invalid. The commit message says the issue was reported by Project Loupe.
Treat as a low-to-moderate hardening fix. Review callers of set_bit to ensure errors are handled, and consider whether any other feature-bit APIs need similar bounds enforcement.
Security signals we found
Bounds check added to prevent unbounded vector growth
Rejects feature bits that cannot be serialized per BOLT length constraints
Reported by external party (Project Loupe)
Potential denial-of-service/resource exhaustion vector mitigated
Evidence from the diff
In lightning-types/src/features.rs, the set_bit helper now returns Err(()) when byte_offset >= u16::MAX as usize. Previously, a caller could set an arbitrarily high bit, causing the internal features vector to grow without bound and producing a state that could not be encoded into a 16-bit length-prefixed BOLT feature vector. The patch is a guard against out-of-spec feature bits and potential DoS/resource exhaustion from pathological inputs.
Changed components
lightning-types/src/features.rsFeatures<T>::set_bitInspect captured patch +3 / −0
diff --git a/lightning-types/src/features.rs b/lightning-types/src/features.rs
index 21d59b2..a55e811 100644
--- a/lightning-types/src/features.rs
+++ b/lightning-types/src/features.rs
@@ -1268,6 +1268,9 @@ impl<T: sealed::Context> Features<T> {
fn set_bit(&mut self, bit: usize, custom: bool) -> Result<(), ()> {
let byte_offset = bit / 8;
let mask = 1 << (bit - 8 * byte_offset);
+ if byte_offset >= u16::MAX as usize {
+ return Err(());
+ }
if byte_offset < T::KNOWN_FEATURE_MASK.len() && custom {
if (T::KNOWN_FEATURE_MASK[byte_offset] & mask) != 0 {
return Err(());
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.