ipfs/go-graphsync

Recover from panics in messaging layer

rvagg opened this issue · 0 comments

rvagg commented

Continuing from #359 (comment)

Since the messaging layer is using some new, and quite complex, machinery from inside go-ipld-prime, and we've been progressively chasing down panics since it started being used. We should probably wrap the both serialization and deserialization of v2 messages in a panic recovery so we don't open ourselves up to a DoS vector from there. We expect it to stabilise and improve over time, and theres work underway already to do some fuzzing at that layer of go-ipld-prime; but for now it seems judicious that we take a precautionary approach.