Security review TODO #904
Security review TODO #904
Conversation
| let hash = Hash::digest_bytes(&buffer); | ||
|
|
||
| let mut nonce = [0u8; NONCE_SIZE]; | ||
| nonce[..NONCE_TAG_SIZE].copy_from_slice(&hash.as_ref()[..NONCE_TAG_SIZE]); |
There was a problem hiding this comment.
NB: NONCE_TAG_SIZE < NONCE_SIZE
| fn get(&self, key: Vec<u8>) -> Fallible<Vec<u8>> { | ||
| self.0 | ||
| .lock() | ||
| .unwrap() |
There was a problem hiding this comment.
NB: if lock doesn't block and is about to unwrap a failure, something has gone horribly wrong, so panicking is an okay strategy
| @@ -0,0 +1,27 @@ | |||
| -----BEGIN RSA PRIVATE KEY----- | |||
There was a problem hiding this comment.
NB: some security audit tools will complain about private keys checked into the repo, which necessitates a filter branch and rewriting history.
| .map(move |blk| { | ||
| let mut polls = polls.lock(); | ||
| // +1, since we don't want to include the current block. | ||
| let id = polls.create_poll(PollFilter::Block(blk.number_u64() + 1)); |
There was a problem hiding this comment.
// TODO(nhynes) does translator ever return u64::max_value()?
update: it might, but that would imply consensus failure, which is already catastrophic
| }, | ||
| extra_info: { | ||
| lazy_static! { | ||
| // Dummy PoW-related block extras. |
There was a problem hiding this comment.
why is this a lazy_static!?
| }) | ||
| .and_then(|logs: Vec<LocalizedLogEntry>| { | ||
| let mut logs = logs; | ||
| logs.sort_by(|a, b| a.block_number.partial_cmp(&b.block_number).unwrap()); |
There was a problem hiding this comment.
| logs.sort_by(|a, b| a.block_number.partial_cmp(&b.block_number).unwrap()); | |
| logs.sort_by(|a, b| a.block_number.cmp(&b.block_number)); |
| id: BlockId, | ||
| ) -> impl Future<Item = U256, Error = CallError> { | ||
| self.simulate_transaction(transaction, id) | ||
| .map(|executed| executed.gas_used + executed.refunded) |
There was a problem hiding this comment.
this won't overflow because gas_used + refunded <= U256::max_value() else parity is buggy
| } | ||
|
|
||
| // Check whether transaction fits in the block. | ||
| let gas_remaining = U256::from(BLOCK_GAS_LIMIT) - ectx.env_info.gas_used; |
There was a problem hiding this comment.
ectx.env_info.gas_used should not exceed BLOCK_GAS_LIMIT since no tx will be added if it wouldn't fit (see next line)
No description provided.