Git-Mirrors/monero
1
0
Fork 0
mirror of https://github.com/monero-project/monero.git synced 2025-08-09 00:32:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

replace most boost serialization with existing monero serialization

Browse source 
This reduces the attack surface for data that can come from
malicious sources (exported output and key images, multisig
transactions...) since the monero serialization is already
exposed to the outside, and the boost lib we were using had
a few known crashers.

For interoperability, a new load-deprecated-formats wallet
setting is added (off by default). This allows loading boost
format data if there is no alternative. It will likely go
at some point, along with the ability to load those.

Notably, the peer lists file still uses the boost serialization
code, as the data it stores is define in epee, while the new
serialization code is in monero, and migrating it was fairly
hairy. Since this file is local and not obtained from anyone
else, the marginal risk is minimal, but it could be migrated
later if needed.

Some tests and tools also do, this will stay as is for now.
This commit is contained in:
moneromooo-monero 2020-06-24 23:26:58 +00:00
parent 43a4fd9e16
commit 7175dcb107
No known key found for this signature in database
GPG key ID: 686F07454D6CEFC3
34 changed files with 837 additions and 392 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/wallet/wallet_rpc_server.cpp
View file

@ -838,10 +838,11 @@ namespace tools
static std::string ptx_to_string(const tools::wallet2::pending_tx &ptx)
{
std::ostringstream oss;
boost::archive::portable_binary_oarchive ar(oss);
binary_archive<true> ar(oss);
try
{
ar << ptx;
if (!::serialization::serialize(ar, const_cast<tools::wallet2::pending_tx&>(ptx)))
return "";
}
catch (...)
{
@ -1550,14 +1551,31 @@ namespace tools
return false;
}
bool loaded = false;
tools::wallet2::pending_tx ptx;
try
{
std::istringstream iss(blob);
boost::archive::portable_binary_iarchive ar(iss);
ar >> ptx;
binary_archive<false> ar(iss);
if (::serialization::serialize(ar, ptx))
loaded = true;
}
catch (...)
catch(...) {}
if (!loaded && !m_restricted)
{
try
{
std::istringstream iss(blob);
boost::archive::portable_binary_iarchive ar(iss);
ar >> ptx;
loaded = true;
}
catch (...) {}
}
if (!loaded)
{
er.code = WALLET_RPC_ERROR_CODE_BAD_TX_METADATA;
er.message = "Failed to parse tx metadata.";