flamenco, gossip: fix OOB on voter-in link

ravyu-jump · ravyu-jump · commit 5eeb524af8ca · 2025-04-14T21:37:33.000Z
diff --git a/src/discof/gossip/fd_gossip_tile.c b/src/discof/gossip/fd_gossip_tile.c
@@ -446,7 +446,7 @@ during_frag( fd_gossip_tile_ctx_t * ctx,
   }
 
   if( in_kind == IN_KIND_VOTER ) {
-    if( FD_UNLIKELY( chunk<in_ctx->chunk0 || chunk>in_ctx->wmark || sz>USHORT_MAX ) ) {
+    if( FD_UNLIKELY( chunk<in_ctx->chunk0 || chunk>in_ctx->wmark || sz>FD_TXN_MTU ) ) {
       FD_LOG_ERR(( "chunk %lu %lu corrupt, not in range [%lu,%lu]", chunk, sz, in_ctx->chunk0, in_ctx->wmark ));
     }
 

Original file line number	Diff line number	Diff line change
`@@ -446,7 +446,7 @@ during_frag( fd_gossip_tile_ctx_t * ctx,`
`446`	`446`	`}`
`447`	`447`
`448`	`448`	`if( in_kind == IN_KIND_VOTER ) {`
`449`		`- if( FD_UNLIKELY( chunk<in_ctx->chunk0 \|\| chunk>in_ctx->wmark \|\| sz>USHORT_MAX ) ) {`
	`449`	`+ if( FD_UNLIKELY( chunk<in_ctx->chunk0 \|\| chunk>in_ctx->wmark \|\| sz>FD_TXN_MTU ) ) {`
`450`	`450`	`FD_LOG_ERR(( "chunk %lu %lu corrupt, not in range [%lu,%lu]", chunk, sz, in_ctx->chunk0, in_ctx->wmark ));`
`451`	`451`	`}`
`452`	`452`