Files
cosmos-sdk/crypto/hd
Emmanuel T Odeke f970056a92 crypto/hd: make DerivePrivateKeyForPath error and not panic on trailing slashes (#8607)
Detected during my audit, right before fuzzing, the code that
checked for presence of hyphens per path segment assumed that
the part would always be non-empty. However, with paths such as:
* m/4/
* /44/
* m/4///

it'd panic with a runtime slice out of bounds.

With this new change, we now:
* firstly strip the right trailing slash
* on finding any empty segments of a path return an error

Fixes #8557
2021-02-17 10:30:04 +00:00
..
2020-04-08 11:38:28 +02:00