fix(scanner): guard against out-of-range currency byte in scan frame - #1124
Merged
Conversation
github-actions
Bot
added
type: fix
A foreign or corrupt Kik code can pass error-correction yet carry a currency byte outside CurrencyCode's range. PayloadKind.Payment.decode indexed CurrencyCode.entries with that untrusted 0-255 byte, so a frame with byte[1] = 232 threw IndexOutOfBoundsException against the 171-entry enum. Because the scanner decodes every camera frame, this stormed Bugsnag (~every 50ms) and silently broke scanning for affected users. PayloadKind.decode is now nullable: Payment.decode returns null when the currency index is out of range instead of throwing, and OpenCodePayload.fromList maps a null decode to Empty (Unknown), which the scanner ignores — no crash and no bogus grab attempt. Adds regression + boundary tests. Bugsnag: 6a5a4523e96556123eba0d68 Signed-off-by: Brandon McAnsh <git@bmcreations.dev>
bmc08gt
force-pushed
the
fix/scanner-currency-index-oob
branch
from
July 23, 2026 17:21
8c7a6f5 to
6bfe7c6
Compare
bmc08gt
added a commit
that referenced
this pull request
Jul 24, 2026
…1124) A foreign or corrupt Kik code can pass error-correction yet carry a currency byte outside CurrencyCode's range. PayloadKind.Payment.decode indexed CurrencyCode.entries with that untrusted 0-255 byte, so a frame with byte[1] = 232 threw IndexOutOfBoundsException against the 171-entry enum. Because the scanner decodes every camera frame, this stormed Bugsnag (~every 50ms) and silently broke scanning for affected users. PayloadKind.decode is now nullable: Payment.decode returns null when the currency index is out of range instead of throwing, and OpenCodePayload.fromList maps a null decode to Empty (Unknown), which the scanner ignores — no crash and no bogus grab attempt. Adds regression + boundary tests. Bugsnag: 6a5a4523e96556123eba0d68 Signed-off-by: Brandon McAnsh <git@bmcreations.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a scanner crash (Bugsnag
6a5a4523e96556123eba0d68) —IndexOutOfBoundsException: Index 232 out of bounds for length 171, ~80 events / 3 users, live on production 2026.7.4.A cash scan frame's byte 1 is an index into
CurrencyCode. A foreign or corrupt Kik code can pass Reed–Solomon error-correction yet carry a currency byte outside that range, andPayloadKind.Payment.decodeindexedCurrencyCode.entries(171 entries) with that untrusted 0–255 byte. A frame withbyte[1] = 232threw against the enum. Because the scanner decodes every camera frame, the exception stormed (~every 50 ms) and silently broke scanning for affected users.Change
OpenCodePayload.fromListnow short-circuits payment frames whose currency index is out of range toEmpty(Unknown), whichCodeScanDelegateignores — no crash and no bogus grab attempt on non-Flipcash codes. Valid currencies (including the highest ordinal) are unaffected.Testing
fromListwithbyte[1] = 232no longer throws and decodes toUnknown.Cash.com.getcode.opencode.model.*suite green.