-
Notifications
You must be signed in to change notification settings - Fork 177
Potential panic in Signature::try_from #563
Description
What
Using Signature::try_from can panic in a specific case, due to the interactions between rust's auto-implementations and user oversight.
Expected Behavior
try_from should either return an Ok or Error
Actual Behavior
Given the following code, if the user makes the mistake of passing the bytes as value [u8; 64] instead of a reference &[u8], try_from will accept that input and potentially panic at runtime for invalid input.
let sig = [255u8; 64];
if let Ok(s) = Signature::try_from(sig) { // should've been `sig.as_ref()`
...
}thread 'main' panicked at 'invalid signature: signature::Error { source: None }', /home/user/.cargo/registry/src/github.zerozr99.workers.dev-1ecc6299db9ec823/ed25519-1.5.2/src/lib.rs:331:38
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Explanation
This is because the From<[u8; 64]> albeit deprecated, is still implemented. Even though TryFrom<&[u8]> is the only impl available, Rust auto-impls TryFrom<[u8; 64]> via From<u8; 64>.
This is quite significant as a single error can give the user the impression that they'll get a Result, whereas the codepath can potentially panic instead.
Removing From<[u8; 64]> implementation should fix this behavior.