Added verifying of encoded RLP length to be not greater than available data size

ethereumj-core/src/main/java/org/ethereum/util/RLP.java

@@ -525,6 +525,10 @@ private static int calcLength(int lengthOfLength, byte[] msgData, int pos) {
             length += bt << shift;
             pow--;
         }
+
+        // check that length is in payload bounds
+        verifyLength(length, msgData.length - pos - lengthOfLength);
+
         return length;
     }
 
@@ -580,10 +584,8 @@ private static void fullTraverse(byte[] msgData, int level, int startPos,
                         throw new RuntimeException("Short list has been encoded as long list");
                     }
 
-                    // check payload bounds
-                    if (length > msgData.length - pos - lengthOfLength) {
-                        throw new RuntimeException("Parsed data lays outside of RLP length boundaries");
-                    }
+                    // check that length is in payload bounds
+                    verifyLength(length, msgData.length - pos - lengthOfLength);
 
                     byte[] rlpData = new byte[lengthOfLength + length + 1];
                     System.arraycopy(msgData, pos, rlpData, 0, lengthOfLength
@@ -633,10 +635,8 @@ private static void fullTraverse(byte[] msgData, int level, int startPos,
                         throw new RuntimeException("Short item has been encoded as long item");
                     }
 
-                    // check payload bounds
-                    if (length > msgData.length - pos - lengthOfLength) {
-                        throw new RuntimeException("Parsed data lays outside of RLP length boundaries");
-                    }
+                    // check that length is in payload bounds
+                    verifyLength(length, msgData.length - pos - lengthOfLength);
 
                     // now we can parse an item for data[1]..data[length]
                     byte[] item = new byte[length];
@@ -694,6 +694,19 @@ private static void fullTraverse(byte[] msgData, int level, int startPos,
         }
     }
 
+    /**
+     * Compares supplied length information with maximum possible
+     * @param suppliedLength    Length info from header
+     * @param availableLength   Length of remaining object
+     * @throws RuntimeException if supplied length is bigger than available
+     */
+    private static void verifyLength(int suppliedLength, int availableLength) {
+        if (suppliedLength > availableLength) {
+            throw new RuntimeException(String.format("Length parsed from RLP (%s bytes) is greater " +
+                            "than remaining size of data (%s bytes)", suppliedLength, availableLength));
+        }
+    }
+
     /**
      * Reads any RLP encoded byte-array and returns all objects as byte-array or list of byte-arrays
      *
@@ -716,6 +729,8 @@ public static DecodeResult decode(byte[] data, int pos) {
         } else if (prefix < OFFSET_SHORT_LIST) {  // [0xb8, 0xbf]
             int lenlen = prefix - OFFSET_LONG_ITEM; // length of length the encoded bytes
             int lenbytes = byteArrayToInt(copyOfRange(data, pos + 1, pos + 1 + lenlen)); // length of encoded bytes
+            // check that length is in payload bounds
+            verifyLength(lenbytes, data.length - pos - 1 - lenlen);
             return new DecodeResult(pos + 1 + lenlen + lenbytes, copyOfRange(data, pos + 1 + lenlen, pos + 1 + lenlen
                     + lenbytes));
         } else if (prefix <= OFFSET_LONG_LIST) {  // [0xc0, 0xf7]
@@ -825,6 +840,9 @@ public static LList decodeLazyList(byte[] data, int pos, int length) {
 
 
     private static DecodeResult decodeList(byte[] data, int pos, int prevPos, int len) {
+        // check that length is in payload bounds
+        verifyLength(len, data.length - pos);
+
         List<Object> slice = new ArrayList<>();
         for (int i = 0; i < len; ) {
             // Get the next item in the data list and append it