Skip to content

Potential panic in Signature::try_from #563

@nbaztec

Description

@nbaztec

What
Using Signature::try_from can panic in a specific case, due to the interactions between rust's auto-implementations and user oversight.

Expected Behavior
try_from should either return an Ok or Error

Actual Behavior
Given the following code, if the user makes the mistake of passing the bytes as value [u8; 64] instead of a reference &[u8], try_from will accept that input and potentially panic at runtime for invalid input.

let sig = [255u8; 64];
if let Ok(s) = Signature::try_from(sig) {  // should've been `sig.as_ref()`
  ...
}
thread 'main' panicked at 'invalid signature: signature::Error { source: None }', /home/user/.cargo/registry/src/github.zerozr99.workers.dev-1ecc6299db9ec823/ed25519-1.5.2/src/lib.rs:331:38
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Explanation
This is because the From<[u8; 64]> albeit deprecated, is still implemented. Even though TryFrom<&[u8]> is the only impl available, Rust auto-impls TryFrom<[u8; 64]> via From<u8; 64>.

This is quite significant as a single error can give the user the impression that they'll get a Result, whereas the codepath can potentially panic instead.

Removing From<[u8; 64]> implementation should fix this behavior.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions