Skip to content

fix(p2p): validate received node info to prevent nil NetAddress crash#5251

Merged
thehowl merged 3 commits intognolang:masterfrom
omarsy:fix/NEWTENDG-161
Mar 17, 2026
Merged

fix(p2p): validate received node info to prevent nil NetAddress crash#5251
thehowl merged 3 commits intognolang:masterfrom
omarsy:fix/NEWTENDG-161

Conversation

@omarsy
Copy link
Member

@omarsy omarsy commented Mar 7, 2026

Fix handshake validation to check the received peer NodeInfo (not local NodeInfo), closing a path where malformed peer payloads could bypass validation and trigger nil dereference later in handshake flow.

Also harden NodeInfo.Validate by rejecting nil NetAddress explicitly.

Tests:

  • add NodeInfo.Validate regression for missing NetAddress

  • add transport handshake regression for malformed peer node info

Context: NEWTENDG-161

@github-actions github-actions bot added the 📦 🌐 tendermint v2 Issues or PRs tm2 related label Mar 7, 2026
@Gno2D2 Gno2D2 added the review/triage-pending PRs opened by external contributors that are waiting for the 1st review label Mar 7, 2026
@Gno2D2
Copy link
Collaborator

Gno2D2 commented Mar 7, 2026

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):
  • IGNORE the bot requirements for this PR (force green CI check)
Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Maintainers must be able to edit this pull request (more info)
🟢 Pending initial approval by a review team member, or review from tech-staff

☑️ Contributor Actions:
  1. Fix any issues flagged by automated checks.
  2. Follow the Contributor Checklist to ensure your PR is ready for review.
    • Add new tests, or document why they are unnecessary.
    • Provide clear examples/screenshots, if necessary.
    • Update documentation, if required.
    • Ensure no breaking changes, or include BREAKING CHANGE notes.
    • Link related issues/PRs, where applicable.
☑️ Reviewer Actions:
  1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.
📚 Resources:
Debug
Automated Checks
Maintainers must be able to edit this pull request (more info)

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 The pull request was created from a fork (head branch repo: omarsy/gno)

Then

🟢 Requirement satisfied
└── 🟢 Maintainer can modify this pull request

Pending initial approval by a review team member, or review from tech-staff

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Not (🔴 Pull request author is a member of the team: tech-staff)

Then

🟢 Requirement satisfied
└── 🟢 If
    ├── 🟢 Condition
    │   └── 🟢 Or
    │       ├── 🔴 At least one of these user(s) reviewed the pull request: [jefft0 notJoon omarsy MikaelVallenet] (with state "APPROVED")
    │       ├── 🟢 At least 1 user(s) of the team tech-staff reviewed pull request
    │       └── 🔴 This pull request is a draft
    └── 🟢 Then
        └── 🟢 Not (🔴 This label is applied to pull request: review/triage-pending)

Manual Checks
**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

  • Any user with comment edit permission

@codecov
Copy link

codecov bot commented Mar 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Fix handshake validation to check the received peer NodeInfo (not local NodeInfo), closing a path where malformed peer payloads could bypass validation and trigger nil dereference later in handshake flow.

Also harden NodeInfo.Validate by rejecting nil NetAddress explicitly.

Tests:

- add NodeInfo.Validate regression for missing NetAddress

- add transport handshake regression for malformed peer node info

Context: NEWTENDG-161
@Kouteki Kouteki moved this from Triage to In Review in 🧙‍♂️Gno.land development Mar 16, 2026
@Kouteki Kouteki requested review from aeddi, gfanton, ltzmaxwell and thehowl and removed request for ltzmaxwell and thehowl March 16, 2026 15:17
Copy link
Contributor

@ltzmaxwell ltzmaxwell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@Gno2D2 Gno2D2 removed the review/triage-pending PRs opened by external contributors that are waiting for the 1st review label Mar 17, 2026
@thehowl thehowl merged commit 553b1c7 into gnolang:master Mar 17, 2026
113 checks passed
@github-project-automation github-project-automation bot moved this from Waiting for Internal Review (PR) to Ready For Core Review (PR) in Security Bugs - HackenProof Workflow Mar 17, 2026
@github-project-automation github-project-automation bot moved this from In Progress to Done in 💪 Bounties & Worx Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

📦 🌐 tendermint v2 Issues or PRs tm2 related

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

5 participants