From 5abb7463add01525bdf0f2df01eb6036e803ab81 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Thu, 6 Oct 2016 10:57:36 +0200
Subject: [PATCH] whsiper: updated envelope validation

---
 whisper/whisperv5/message.go |  5 +++--
 whisper/whisperv5/whisper.go | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/whisper/whisperv5/message.go b/whisper/whisperv5/message.go
index 282b1dc6b7..17c5569313 100644
--- a/whisper/whisperv5/message.go
+++ b/whisper/whisperv5/message.go
@@ -28,6 +28,7 @@ import (
 	"crypto/sha256"
 	"errors"
 	"fmt"
+	mrand "math/rand"
 
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/crypto"
@@ -106,7 +107,7 @@ func DeriveOneTimeKey(key []byte, salt []byte, version uint64) ([]byte, error) {
 func NewSentMessage(params *MessageParams) *SentMessage {
 	// Construct an initial flag set: no signature, no padding, other bits random
 	buf := make([]byte, 1)
-	crand.Read(buf)
+	mrand.Read(buf)
 	flags := buf[0]
 	flags &= ^paddingMask
 	flags &= ^signatureFlag
@@ -140,7 +141,7 @@ func (msg *SentMessage) appendPadding(params *MessageParams) {
 			panic("please fix the padding algorithm before releasing new version")
 		}
 		buf := make([]byte, padSize)
-		crand.Read(buf[1:])
+		mrand.Read(buf[1:])
 		buf[0] = byte(padSize)
 		if params.Padding != nil {
 			copy(buf[1:], params.Padding)
diff --git a/whisper/whisperv5/whisper.go b/whisper/whisperv5/whisper.go
index 7be33e24b5..17d0b62816 100644
--- a/whisper/whisperv5/whisper.go
+++ b/whisper/whisperv5/whisper.go
@@ -385,6 +385,20 @@ func (wh *Whisper) add(envelope *Envelope) error {
 		return fmt.Errorf("huge messages are not allowed")
 	}
 
+	if len(envelope.Version) > 4 {
+		return fmt.Errorf("oversized Version")
+	}
+
+	if len(envelope.AESNonce) > 12 {
+		// the standard AES GSM nonce size is 12,
+		// but const gcmStandardNonceSize cannot be accessed directly
+		return fmt.Errorf("oversized AESNonce")
+	}
+
+	if len(envelope.Salt) > saltLength {
+		return fmt.Errorf("oversized Salt")
+	}
+
 	if envelope.PoW() < MinimumPoW {
 		glog.V(logger.Debug).Infof("envelope with low PoW dropped: %f", envelope.PoW())
 		return nil // drop envelope without error