You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

92 lines
6.5 KiB

rpc/jsonrpc: Unmarshal RPCRequest correctly (#6191) i.e. without double pointer. With double pointer, it was possible to submit `null` value, which will crash the server. ``` panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x189ddc0] goroutine 1 [running]: github.com/tendermint/tendermint/rpc/jsonrpc/types.(*RPCRequest).UnmarshalJSON(0xc0000147e0, 0xc00029f201, 0x4, 0x1ff, 0x883baa0, 0xc0000147e0) /Users/anton/go/src/github.com/tendermint/tendermint/rpc/jsonrpc/types/types.go:70 +0x100 encoding/json.(*decodeState).literalStore(0xc000216bb0, 0xc00029f201, 0x4, 0x1ff, 0x1998800, 0xc0000147e0, 0x199, 0xc000231700, 0x10e0a5e, 0x197) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:860 +0x30ce encoding/json.(*decodeState).value(0xc000216bb0, 0x1998800, 0xc0000147e0, 0x199, 0x1998800, 0xc0000147e0) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:384 +0x40c encoding/json.(*decodeState).array(0xc000216bb0, 0x18df040, 0xc0001be540, 0x16, 0xc000216bd8, 0x10e405b) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:558 +0x365 encoding/json.(*decodeState).value(0xc000216bb0, 0x18df040, 0xc0001be540, 0x16, 0x16, 0x6e) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:360 +0x22f encoding/json.(*decodeState).unmarshal(0xc000216bb0, 0x18df040, 0xc0001be540, 0xc000216bd8, 0x0) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:180 +0x2c9 encoding/json.Unmarshal(0xc00029f200, 0x6, 0x200, 0x18df040, 0xc0001be540, 0x0, 0x0) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:107 +0x15d ```
3 years ago
rpc/jsonrpc: Unmarshal RPCRequest correctly (#6191) i.e. without double pointer. With double pointer, it was possible to submit `null` value, which will crash the server. ``` panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x189ddc0] goroutine 1 [running]: github.com/tendermint/tendermint/rpc/jsonrpc/types.(*RPCRequest).UnmarshalJSON(0xc0000147e0, 0xc00029f201, 0x4, 0x1ff, 0x883baa0, 0xc0000147e0) /Users/anton/go/src/github.com/tendermint/tendermint/rpc/jsonrpc/types/types.go:70 +0x100 encoding/json.(*decodeState).literalStore(0xc000216bb0, 0xc00029f201, 0x4, 0x1ff, 0x1998800, 0xc0000147e0, 0x199, 0xc000231700, 0x10e0a5e, 0x197) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:860 +0x30ce encoding/json.(*decodeState).value(0xc000216bb0, 0x1998800, 0xc0000147e0, 0x199, 0x1998800, 0xc0000147e0) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:384 +0x40c encoding/json.(*decodeState).array(0xc000216bb0, 0x18df040, 0xc0001be540, 0x16, 0xc000216bd8, 0x10e405b) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:558 +0x365 encoding/json.(*decodeState).value(0xc000216bb0, 0x18df040, 0xc0001be540, 0x16, 0x16, 0x6e) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:360 +0x22f encoding/json.(*decodeState).unmarshal(0xc000216bb0, 0x18df040, 0xc0001be540, 0xc000216bd8, 0x0) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:180 +0x2c9 encoding/json.Unmarshal(0xc00029f200, 0x6, 0x200, 0x18df040, 0xc0001be540, 0x0, 0x0) /usr/local/Cellar/go/1.16/libexec/src/encoding/json/decode.go:107 +0x15d ```
3 years ago
  1. # Unreleased Changes
  2. ## vX.X
  3. Special thanks to external contributors on this release:
  4. Friendly reminder: We have a [bug bounty program](https://hackerone.com/tendermint).
  5. ### BREAKING CHANGES
  6. - CLI/RPC/Config
  7. - [config] \#5598 The `test_fuzz` and `test_fuzz_config` P2P settings have been removed. (@erikgrinaker)
  8. - [config] \#5728 `fast_sync = "v1"` is no longer supported (@melekes)
  9. - [cli] \#5772 `gen_node_key` prints JSON-encoded `NodeKey` rather than ID and does not save it to `node_key.json` (@melekes)
  10. - [cli] \#5777 use hyphen-case instead of snake_case for all cli commands and config parameters (@cmwaters)
  11. - [rpc] \#6019 standardise RPC errors and return the correct status code (@bipulprasad & @cmwaters)
  12. - [rpc] \#6168 Change default sorting to desc for `/tx_search` results (@melekes)
  13. - [cli] \#6282 User must specify the node mode when using `tendermint init` (@cmwaters)
  14. - Apps
  15. - [ABCI] \#5447 Remove `SetOption` method from `ABCI.Client` interface
  16. - [ABCI] \#5447 Reset `Oneof` indexes for `Request` and `Response`.
  17. - [ABCI] \#5818 Use protoio for msg length delimitation. Migrates from int64 to uint64 length delimiters.
  18. - P2P Protocol
  19. - Go API
  20. - [abci/client, proxy] \#5673 `Async` funcs return an error, `Sync` and `Async` funcs accept `context.Context` (@melekes)
  21. - [p2p] Removed unused function `MakePoWTarget`. (@erikgrinaker)
  22. - [libs/bits] \#5720 Validate `BitArray` in `FromProto`, which now returns an error (@melekes)
  23. - [proto/p2p] Renamed `DefaultNodeInfo` and `DefaultNodeInfoOther` to `NodeInfo` and `NodeInfoOther` (@erikgrinaker)
  24. - [proto/p2p] Rename `NodeInfo.default_node_id` to `node_id` (@erikgrinaker)
  25. - [libs/os] Kill() and {Must,}{Read,Write}File() functions have been removed. (@alessio)
  26. - [store] \#5848 Remove block store state in favor of using the db iterators directly (@cmwaters)
  27. - [state] \#5864 Use an iterator when pruning state (@cmwaters)
  28. - [types] \#6023 Remove `tm2pb.Header`, `tm2pb.BlockID`, `tm2pb.PartSetHeader` and `tm2pb.NewValidatorUpdate`.
  29. - Each of the above types has a `ToProto` and `FromProto` method or function which replaced this logic.
  30. - [light] \#6054 Move `MaxRetryAttempt` option from client to provider.
  31. - `NewWithOptions` now sets the max retry attempts and timeouts (@cmwaters)
  32. - [all] \#6077 Change spelling from British English to American (@cmwaters)
  33. - Rename "Subscription.Cancelled()" to "Subscription.Canceled()" in libs/pubsub
  34. - Rename "behaviour" pkg to "behavior" and internalized it in blockchain v2
  35. - [rpc/client/http] \#6176 Remove `endpoint` arg from `New`, `NewWithTimeout` and `NewWithClient` (@melekes)
  36. - [rpc/client/http] \#6176 Unexpose `WSEvents` (@melekes)
  37. - [rpc/jsonrpc/client/ws_client] \#6176 `NewWS` no longer accepts options (use `NewWSWithOptions` and `OnReconnect` funcs to configure the client) (@melekes)
  38. - [rpc/jsonrpc/server] \#6204 Modify `WriteRPCResponseHTTP(Error)` to return an error (@melekes)
  39. - Blockchain Protocol
  40. - Data Storage
  41. - [store/state/evidence/light] \#5771 Use an order-preserving varint key encoding (@cmwaters)
  42. ### FEATURES
  43. - [rpc] \#6226 Index block events and expose a new RPC method, `/block_search`, to allow querying for blocks by `BeginBlock` and `EndBlock` events. (@alexanderbez)
  44. - [config] Add `--mode` flag and config variable. See [ADR-52](https://github.com/tendermint/tendermint/blob/master/docs/architecture/adr-052-tendermint-mode.md) @dongsam
  45. ### IMPROVEMENTS
  46. - [crypto/ed25519] \#5632 Adopt zip215 `ed25519` verification. (@marbar3778)
  47. - [privval] \#5603 Add `--key` to `init`, `gen_validator`, `testnet` & `unsafe_reset_priv_validator` for use in generating `secp256k1` keys.
  48. - [privval] \#5725 Add gRPC support to private validator.
  49. - [privval] \#5876 `tendermint show-validator` will query the remote signer if gRPC is being used (@marbar3778)
  50. - [abci/client] \#5673 `Async` requests return an error if queue is full (@melekes)
  51. - [mempool] \#5673 Cancel `CheckTx` requests if RPC client disconnects or times out (@melekes)
  52. - [abci] \#5706 Added `AbciVersion` to `RequestInfo` allowing applications to check ABCI version when connecting to Tendermint. (@marbar3778)
  53. - [blockchain/v1] \#5728 Remove in favor of v2 (@melekes)
  54. - [blockchain/v0] \#5741 Relax termination conditions and increase sync timeout (@melekes)
  55. - [cli] \#5772 `gen_node_key` output now contains node ID (`id` field) (@melekes)
  56. - [blockchain/v2] \#5774 Send status request when new peer joins (@melekes)
  57. - [consensus] \#5792 Deprecates the `time_iota_ms` consensus parameter, to reduce the bug surface. The parameter is no longer used. (@valardragon)
  58. - [store] \#5888 store.SaveBlock saves using batches instead of transactions for now to improve ACID properties. This is a quick fix for underlying issues around tm-db and ACID guarantees. (@githubsands)
  59. - [consensus] \#5987 Remove `time_iota_ms` from consensus params. Merge `tmproto.ConsensusParams` and `abci.ConsensusParams`. (@marbar3778)
  60. - [types] \#5994 Reduce the use of protobuf types in core logic. (@marbar3778)
  61. - `ConsensusParams`, `BlockParams`, `ValidatorParams`, `EvidenceParams`, `VersionParams`, `sm.Version` and `version.Consensus` have become native types. They still utilize protobuf when being sent over the wire or written to disk.
  62. - [rpc/client/http] \#6163 Do not drop events even if the `out` channel is full (@melekes)
  63. - [node] \#6059 Validate and complete genesis doc before saving to state store (@silasdavis)
  64. - [state] \#6067 Batch save state data (@githubsands & @cmwaters)
  65. - [crypto] \#6120 Implement batch verification interface for ed25519 and sr25519. (@marbar3778)
  66. - [types] \#6120 use batch verification for verifying commits signatures.
  67. - If the key type supports the batch verification API it will try to batch verify. If the verification fails we will single verify each signature.
  68. - [privval/file] \#6185 Return error on `LoadFilePV`, `LoadFilePVEmptyState`. Allows for better programmatic control of Tendermint.
  69. - [privval] /#6240 Add `context.Context` to privval interface.
  70. ### BUG FIXES
  71. - [types] \#5523 Change json naming of `PartSetHeader` within `BlockID` from `parts` to `part_set_header` (@marbar3778)
  72. - [privval] \#5638 Increase read/write timeout to 5s and calculate ping interval based on it (@JoeKash)
  73. - [blockchain/v1] [\#5701](https://github.com/tendermint/tendermint/pull/5701) Handle peers without blocks (@melekes)
  74. - [blockchain/v1] \#5711 Fix deadlock (@melekes)
  75. - [rpc/jsonrpc/server] \#6191 Correctly unmarshal `RPCRequest` when data is `null` (@melekes)
  76. - [light/evidence] Adds logic to handle forward lunatic attacks (@cmwaters)