GHSA-xc79-566c-j4qx: Parallax is vulnerable to DoS via malicious p2p message

The vulnerability is a Denial of Service (DoS) in the Parallax Ethereum client, caused by an integer underflow when processing a GetBlockHeadersRequest p2p message. An attacker can send a request with a count of 0. The code then calculates count - 1, which underflows to UINT64_MAX.

This extremely large value is passed down to the rawdb.ReadHeaderRange function. The analysis of the patch f759e9090aaf00a43c616d7cbd133c44bb1ed01e shows that this function was responsible for allocating memory to retrieve block headers. Before the patch, the amount of memory to allocate was calculated based on the count parameter (max := count * 700). When count is UINT64_MAX, this results in an attempt to allocate an extremely large amount of memory, leading to the DoS.

The vulnerable function rawdb.ReadHeaderRange is where the memory exhaustion occurs. During an exploit, this function would appear in a runtime profile with high memory usage. The patch mitigates the vulnerability by replacing the dangerous calculation with a hardcoded 2MB limit for the memory allocation, effectively capping the resource consumption and preventing the DoS attack.