Skip to content

[v0.20.x-branch] Backport #11075: lnwallet: prevent transaction pagination overflow - #11082

Merged
ziggie1984 merged 2 commits into
v0.20.x-branchfrom
backport-11075-to-v0.20.x-branch
Aug 15, 2026
Merged

[v0.20.x-branch] Backport #11075: lnwallet: prevent transaction pagination overflow#11082
ziggie1984 merged 2 commits into
v0.20.x-branchfrom
backport-11075-to-v0.20.x-branch

Conversation

@github-actions

Copy link
Copy Markdown

Backport of #11075


Change Description

ListTransactionDetails accepts indexOffset and maxTransactions as
uint32 values and previously added them before clamping the requested
endpoint to the number of available transactions. The GetTransactions RPC
passes both request fields through without restricting their sum.

A sufficiently large limit can therefore wrap the endpoint modulo 2^32.
For example, an offset of one and a limit of math.MaxUint32 produce an
endpoint of zero. If at least two transactions are available, the resulting
txDetails[1:0] operation raises a runtime slice-bounds panic instead of
returning the remaining transactions.

This PR moves pagination into a focused helper. It checks the offset against
the slice length using uint64, calculates the requested endpoint in uint64,
and converts to int only after the value is proven to be within the slice.

The existing pagination behavior is preserved:

  • a zero limit returns every transaction from the offset;
  • oversized limits are clamped to the available transactions;
  • offsets at or beyond the end return an empty page with zero indices.

The wider offset comparison also avoids an unsafe uint32-to-int
conversion on 32-bit systems.

User Impact

Malformed but authorized GetTransactions pagination values no longer reach a
slice-bounds panic. On versions with RPC panic recovery this avoids an internal
RPC error and recovered-panic log; on versions without that recovery it also
prevents a process-level denial of service.

Steps to Test

go test ./lnwallet/btcwallet -run TestPaginateTransactionDetails -count=1
go test -race ./lnwallet/btcwallet -run TestPaginateTransactionDetails -count=1
go test ./lnwallet/btcwallet -count=1

The regression table covers unlimited, bounded, clamped, overflowing,
end-of-list, and maximum-offset requests. Restoring the old uint32 addition
makes the overflow case panic with a slice bounds error.

This change is extracted from the second commit in Boris Nagaev's
additional range fixes gist.

@github-actions github-actions Bot added this to the v0.21.3 milestone Aug 14, 2026
@github-actions

Copy link
Copy Markdown
Author

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-11075-to-v0.20.x-branch
git worktree add --checkout .worktree/backport-11075-to-v0.20.x-branch backport-11075-to-v0.20.x-branch
cd .worktree/backport-11075-to-v0.20.x-branch
git reset --hard HEAD^
git cherry-pick -x a207fac5a90394cd0f1e6c4fcf732fc7c93d75d5
git push --force-with-lease

@ziggie1984
ziggie1984 force-pushed the backport-11075-to-v0.20.x-branch branch from b52d0dd to 903c495 Compare August 15, 2026 12:11
@ziggie1984
ziggie1984 marked this pull request as ready for review August 15, 2026 12:12

@ziggie1984 ziggie1984 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ziggie1984
ziggie1984 merged commit fd9c193 into v0.20.x-branch Aug 15, 2026
22 of 35 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant