consenus/PeerState: SetHasProposal could be exploited by a malicious peer to crash node since common.BitArray doesn't catch negative lengths before makeslice #1322
Description
I was just auditing the code to check for how a peer could take down all it's peers in one take and I found a way. By broadcasting to all of them a Proposal of a blockstate with a Total <= -127 a malicious peer can take down all of it's peers because:
tendermint/consensus/reactor.go
Lines 241 to 249 in c8a2bdf
tendermint/consensus/reactor.go
Line 887 in c8a2bdf
but then see the code in tendermint/tmlibs/common.NewBitArray https://github.com/tendermint/tmlibs/blob/1b9b5652a199ab0be2e781393fb275b66377309d/common/bit_array.go#L16-L25
and notice the line https://github.com/tendermint/tmlibs/blob/1b9b5652a199ab0be2e781393fb275b66377309d/common/bit_array.go#L18-L20
Which will then crash with
panic: runtime error: makeslice: len out of range [recovered]
panic: runtime error: makeslice: len out of range
goroutine 20 [running]:
testing.tRunner.func1(0xc0001560f0)