diff --git a/common/bolt11.c b/common/bolt11.c index c6eb0bd8f2bc..e84cf6dc784a 100644 --- a/common/bolt11.c +++ b/common/bolt11.c @@ -306,14 +306,26 @@ static const char *decode_n(struct bolt11 *b11, const u5 **data, size_t *field_len, bool *have_n) { + const char *err; + assert(!*have_n); /* BOLT #11: * * A reader... MUST skip over unknown fields, OR an `f` field * with unknown `version`, OR `p`, `h`, `s` or `n` fields that do * NOT have `data_length`s of 52, 52, 52 or 53, respectively. */ - return pull_expected_length(b11, hu5, data, field_len, 53, 'n', - have_n, &b11->receiver_id.k); + err = pull_expected_length(b11, hu5, data, field_len, 53, 'n', + have_n, &b11->receiver_id.k); + + /* If that gave us nodeid, check it. */ + if (*have_n) { + struct pubkey k; + if (!pubkey_from_node_id(&k, &b11->receiver_id)) + return tal_fmt(b11, "invalid public key %s", + node_id_to_hexstr(tmpctx, &b11->receiver_id)); + } + + return err; } /* BOLT #11: diff --git a/tests/fuzz/corpora/fuzz-bolt11-decode/crash-08a0ea0c1dd7003293bf5d6e05708c6918757cd7 b/tests/fuzz/corpora/fuzz-bolt11-decode/crash-08a0ea0c1dd7003293bf5d6e05708c6918757cd7 new file mode 100644 index 000000000000..7bdc44850d72 Binary files /dev/null and b/tests/fuzz/corpora/fuzz-bolt11-decode/crash-08a0ea0c1dd7003293bf5d6e05708c6918757cd7 differ