Verify message, signature and pubkey lengths for ed25519-verify (#58)

Co-authored-by: Luke Wilson <[email protected]>

Author: lukedawilson

src/instance.ts

@@ -11,6 +11,10 @@ export const MAX_LENGTH_DB_VALUE: number = 128 * 1024;
 export const MAX_LENGTH_CANONICAL_ADDRESS: number = 64;
 export const MAX_LENGTH_HUMAN_ADDRESS: number = 256;
 
+export const MAX_LENGTH_ED25519_SIGNATURE: number = 64;
+export const MAX_LENGTH_ED25519_MESSAGE: number = 128 * 1024;
+export const EDDSA_PUBKEY_LEN: number = 32;
+
 export class VMInstance {
   public instance?: WebAssembly.Instance;
   public bech32: BechLib;
@@ -378,6 +382,10 @@ export class VMInstance {
       signature: Region,
       pubkey: Region
   ): number {
+    if (message.length > MAX_LENGTH_ED25519_MESSAGE) return 1;
+    if (signature.length > MAX_LENGTH_ED25519_SIGNATURE) return 1;
+    if (pubkey.length > EDDSA_PUBKEY_LEN) return 1;
+
     const sig = Buffer.from(signature.data).toString('hex');
     const pub = Buffer.from(pubkey.data).toString('hex');
     const msg = Buffer.from(message.data).toString('hex');

test/imports.test.ts

@@ -591,7 +591,7 @@ describe('do_ed25519_verify', () => {
     expect(result).toEqual(1);
   });
 
-  it.skip('fails for large sig', () => { // test is broken, only ever passed due to other tests mutating the test data
+  it('fails for large sig', () => {
     const sig = new Uint8Array([...testData.EDDSA_SIG_HEX, 0x00]);
     const hashPtr = writeData(vm, testData.EDDSA_MSG_HEX);
     const sigPtr = writeData(vm, sig);