[v0.20.x-branch] Backport #11075: lnwallet: prevent transaction pagination overflow - #11082
Merged
Merged
Conversation
(cherry picked from commit 62aeca5)
Author
|
Please cherry-pick the changes locally and resolve any conflicts. git fetch origin backport-11075-to-v0.20.x-branch
git worktree add --checkout .worktree/backport-11075-to-v0.20.x-branch backport-11075-to-v0.20.x-branch
cd .worktree/backport-11075-to-v0.20.x-branch
git reset --hard HEAD^
git cherry-pick -x a207fac5a90394cd0f1e6c4fcf732fc7c93d75d5
git push --force-with-lease |
(cherry picked from commit a207fac)
ziggie1984
force-pushed
the
backport-11075-to-v0.20.x-branch
branch
from
August 15, 2026 12:11
b52d0dd to
903c495
Compare
ziggie1984
marked this pull request as ready for review
August 15, 2026 12:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #11075
Change Description
ListTransactionDetailsacceptsindexOffsetandmaxTransactionsasuint32values and previously added them before clamping the requestedendpoint to the number of available transactions. The
GetTransactionsRPCpasses both request fields through without restricting their sum.
A sufficiently large limit can therefore wrap the endpoint modulo
2^32.For example, an offset of one and a limit of
math.MaxUint32produce anendpoint of zero. If at least two transactions are available, the resulting
txDetails[1:0]operation raises a runtime slice-bounds panic instead ofreturning the remaining transactions.
This PR moves pagination into a focused helper. It checks the offset against
the slice length using
uint64, calculates the requested endpoint inuint64,and converts to
intonly after the value is proven to be within the slice.The existing pagination behavior is preserved:
The wider offset comparison also avoids an unsafe
uint32-to-intconversion on 32-bit systems.
User Impact
Malformed but authorized
GetTransactionspagination values no longer reach aslice-bounds panic. On versions with RPC panic recovery this avoids an internal
RPC error and recovered-panic log; on versions without that recovery it also
prevents a process-level denial of service.
Steps to Test
The regression table covers unlimited, bounded, clamped, overflowing,
end-of-list, and maximum-offset requests. Restoring the old
uint32additionmakes the overflow case panic with a slice bounds error.
This change is extracted from the second commit in Boris Nagaev's
additional range fixes gist.