From ba77e48c1299c9d7470d0806f970b34c2bf4fb1e Mon Sep 17 00:00:00 2001 From: Tyera Eulberg Date: Thu, 15 Apr 2021 16:32:29 -0600 Subject: [PATCH] Don't parse uninitialized system/nonce accounts (#16584) --- account-decoder/src/parse_nonce.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/account-decoder/src/parse_nonce.rs b/account-decoder/src/parse_nonce.rs index f75766c77a..aaa305f658 100644 --- a/account-decoder/src/parse_nonce.rs +++ b/account-decoder/src/parse_nonce.rs @@ -9,7 +9,13 @@ pub fn parse_nonce(data: &[u8]) -> Result { .map_err(|_| ParseAccountError::from(InstructionError::InvalidAccountData))?; let nonce_state = nonce_state.convert_to_current(); match nonce_state { - State::Uninitialized => Ok(UiNonceState::Uninitialized), + // This prevents parsing an allocated System-owned account with empty data of any non-zero + // length as `uninitialized` nonce. An empty account of the wrong length can never be + // initialized as a nonce account, and an empty account of the correct length may not be an + // uninitialized nonce account, since it can be assigned to another program. + State::Uninitialized => Err(ParseAccountError::from( + InstructionError::InvalidAccountData, + )), State::Initialized(data) => Ok(UiNonceState::Initialized(UiNonceData { authority: data.authority.to_string(), blockhash: data.blockhash.to_string(),