ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag

Summary

go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A `ProtoNode` should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error from the codec. Manipulation of an existing (newly created or decoded) `ProtoNode` using the modifier methods did not account for certain states that would place the `ProtoNode` into an unencodeable form. Due to conformance with the `github.com/ipfs/go-block-format#Block` and `github.com/ipfs/go-ipld-format#Node` interfaces, certain methods, which internally require a re-encode if state has changed, will panic due to the inability to return an error. This issue has been addressed across a number of pull requests. Users are advised to upgrade to version 0.8.1 for a complete set of fixes. Users unable to upgrade may attempt to mitigate this issue by sanitising inputs when allowing user-input to set a new `CidBuilder` on a `ProtoNode` and by sanitising `Tsize` (`Link#Size`) values such that they are a reasonable byte-size for sub-DAGs where derived from user-input.

Timeline

1. Dec 8, 2022, 9:25 PM UTCCVE published
2. Apr 23, 2025, 3:48 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Apr 23, 2025, 4:31 PM UTCRecord last updated

Affected versions

• ipfs go-merkledag

  From 0.4.0 · fixed in 0.8.1

• github.com/ipfs/go-merkledagGo

  From 0.4.0 · fixed in 0.8.1

References 9