Skip to content

fix(enr): prevent RangeError crash on malformed ENR port values#333

Open
guha-rahul wants to merge 2 commits intoChainSafe:masterfrom
guha-rahul:fix
Open

fix(enr): prevent RangeError crash on malformed ENR port values#333
guha-rahul wants to merge 2 commits intoChainSafe:masterfrom
guha-rahul:fix

Conversation

@guha-rahul
Copy link

Problem

When a peer sends an ENR with a UDP/TCP/QUIC port value less than 2 bytes, getLocationMultiaddr() passes it directly to bytesToValue() which calls DataView.getUint16() internally, throwing an unhandled RangeError that crashes the process .

RangeError: Offset is outside the bounds of the DataView
    at DataView.prototype.getUint16 (<anonymous>)
    at Object.bytes2port [as bytesToValue] (@multiformats/multiaddr/src/utils.ts:25)
    at ENR.getLocationMultiaddr (@chainsafe/enr/src/enr.ts:347)

Solution

Add a protoVal.length < 2 guard alongside the existing !protoVal check for all three protocol branches (udp, tcp, quic) in getLocationMultiaddr().

@guha-rahul guha-rahul requested a review from a team as a code owner March 10, 2026 08:38
if (isUdp) {
const protoVal = isIpv6 ? this.kvs.get("udp6") : this.kvs.get("udp");
if (!protoVal) {
if (!protoVal || protoVal.length < 2) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we want to still attempt to deserialize these values? I don't think its actually "malformed" here to use a single byte for a small port number, its just not really common.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, looking at the rust discv5 they seem to pad it and also some other checks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants