Use DecodeLimit for decoding XCM messages

client/collator/Cargo.toml

@@ -24,7 +24,7 @@ cumulus-client-consensus-common = { path = "../consensus/common" }
 cumulus-primitives-core = { path = "../../primitives/core" }
 
 # Other dependencies
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ] }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ] }
 futures = { version = "0.3.1", features = ["compat"] }
 parking_lot = "0.10.2"
 tracing = "0.1.25"

client/consensus/aura/Cargo.toml

@@ -33,6 +33,6 @@ cumulus-primitives-core = { path = "../../../primitives/core" }
 
 # Other deps
 futures = { version = "0.3.8", features = ["compat"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ] }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ] }
 tracing = "0.1.22"
 async-trait = "0.1.42"

client/consensus/common/Cargo.toml

@@ -20,7 +20,7 @@ polkadot-primitives = { git = "https://github.com/paritytech/polkadot", branch =
 
 # Other deps
 futures = { version = "0.3.8", features = ["compat"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ] }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ] }
 tracing = "0.1.25"
 async-trait = "0.1.42"
 dyn-clone = "1.0.4"

client/network/Cargo.toml

@@ -21,7 +21,7 @@ polkadot-client = { git = "https://github.com/paritytech/polkadot", branch = "ma
 polkadot-parachain = { git = "https://github.com/paritytech/polkadot", branch = "master" }
 
 # other deps
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ] }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ] }
 futures = { version = "0.3.1", features = ["compat"] }
 futures-timer = "3.0.2"
 tracing = "0.1.22"

client/pov-recovery/Cargo.toml

@@ -24,7 +24,7 @@ polkadot-node-subsystem = { git = "https://github.com/paritytech/polkadot", bran
 cumulus-primitives-core = { path = "../../primitives/core" }
 
 # other deps
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ] }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ] }
 futures = { version = "0.3.1", features = ["compat"] }
 futures-timer = "3.0.2"
 tracing = "0.1.22"

client/service/Cargo.toml

@@ -32,5 +32,5 @@ polkadot-overseer = { git = "https://github.com/paritytech/polkadot", branch = "
 
 # Other deps
 tracing = "0.1.22"
-codec = { package = "parity-scale-codec", version = "2.0.0" }
+codec = { package = "parity-scale-codec", version = "2.3.0" }
 parking_lot = "0.10.2"

pallets/aura-ext/Cargo.toml

@@ -17,7 +17,7 @@ sp-runtime = { git = "https://github.com/paritytech/substrate", default-features
 sp-application-crypto = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }
 
 # Other Dependencies
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"]}
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"]}
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 serde = { version = "1.0.101", optional = true, features = ["derive"] }
 

pallets/collator-selection/Cargo.toml

@@ -14,7 +14,7 @@ targets = ['x86_64-unknown-linux-gnu']
 
 [dependencies]
 log = { version = "0.4.0", default-features = false }
-codec = { default-features = false, features = ['derive'], package = 'parity-scale-codec', version = '2.0.0' }
+codec = { default-features = false, features = ['derive'], package = 'parity-scale-codec', version = '2.3.0' }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 serde = { version = "1.0.119", default-features = false }
 sp-std = { default-features = false, git = 'https://github.com/paritytech/substrate', branch = "master" }

pallets/dmp-queue/Cargo.toml

@@ -6,7 +6,7 @@ edition = "2018"
 
 [dependencies]
 # Other dependencies
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ], default-features = false }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ], default-features = false }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 log = { version = "0.4.14", default-features = false }
 

pallets/dmp-queue/src/lib.rs

@@ -21,7 +21,7 @@
 
 #![cfg_attr(not(feature = "std"), no_std)]
 
-use codec::{Decode, Encode};
+use codec::{Decode, DecodeLimit, Encode};
 use cumulus_primitives_core::{relay_chain::BlockNumber as RelayBlockNumber, DmpMessageHandler};
 use frame_support::{
 	dispatch::Weight, traits::EnsureOrigin, weights::constants::WEIGHT_PER_MILLIS,
@@ -30,7 +30,7 @@ pub use pallet::*;
 use scale_info::TypeInfo;
 use sp_runtime::RuntimeDebug;
 use sp_std::{convert::TryFrom, prelude::*};
-use xcm::{latest::prelude::*, VersionedXcm};
+use xcm::{latest::prelude::*, VersionedXcm, MAX_XCM_DECODE_DEPTH};
 
 #[derive(Copy, Clone, Eq, PartialEq, Encode, Decode, RuntimeDebug, TypeInfo)]
 pub struct ConfigData {
@@ -225,8 +225,11 @@ pub mod pallet {
 			data: &[u8],
 		) -> Result<Weight, (MessageId, Weight)> {
 			let id = sp_io::hashing::blake2_256(&data[..]);
-			let maybe_msg =
-				VersionedXcm::<T::Call>::decode(&mut &data[..]).map(Xcm::<T::Call>::try_from);
+			let maybe_msg = VersionedXcm::<T::Call>::decode_all_with_depth_limit(
+				MAX_XCM_DECODE_DEPTH,
+				&mut &data[..],
+			)
+			.map(Xcm::<T::Call>::try_from);
 			match maybe_msg {
 				Err(_) => {
 					Self::deposit_event(Event::InvalidFormat(id));

pallets/parachain-system/Cargo.toml

@@ -30,7 +30,7 @@ sp-trie = { git = "https://github.com/paritytech/substrate", default-features =
 sp-externalities = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }
 
 # Other Dependencies
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"]}
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"]}
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 serde = { version = "1.0.101", optional = true, features = ["derive"] }
 log = { version = "0.4.14", default-features = false }

pallets/xcm/Cargo.toml

@@ -5,7 +5,7 @@ name = "cumulus-pallet-xcm"
 version = "0.1.0"
 
 [dependencies]
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"] }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 serde = { version = "1.0.101", optional = true, features = ["derive"] }
 

pallets/xcm/src/lib.rs

@@ -20,7 +20,7 @@
 
 #![cfg_attr(not(feature = "std"), no_std)]
 
-use codec::{Decode, Encode};
+use codec::{Decode, DecodeLimit, Encode};
 use cumulus_primitives_core::{
 	relay_chain::BlockNumber as RelayBlockNumber, DmpMessageHandler, ParaId,
 };
@@ -31,7 +31,7 @@ use sp_runtime::traits::BadOrigin;
 use sp_std::{convert::TryFrom, prelude::*};
 use xcm::{
 	latest::{ExecuteXcm, Outcome, Parent, Xcm},
-	VersionedXcm,
+	VersionedXcm, MAX_XCM_DECODE_DEPTH,
 };
 
 #[frame_support::pallet]
@@ -115,7 +115,11 @@ impl<T: Config> DmpMessageHandler for UnlimitedDmpExecution<T> {
 		let mut used = 0;
 		for (_sent_at, data) in iter {
 			let id = sp_io::hashing::twox_64(&data[..]);
-			let msg = VersionedXcm::<T::Call>::decode(&mut &data[..]).map(Xcm::<T::Call>::try_from);
+			let msg = VersionedXcm::<T::Call>::decode_all_with_depth_limit(
+				MAX_XCM_DECODE_DEPTH,
+				&mut &data[..],
+			)
+			.map(Xcm::<T::Call>::try_from);
 			match msg {
 				Err(_) => Pallet::<T>::deposit_event(Event::InvalidFormat(id)),
 				Ok(Err(())) => Pallet::<T>::deposit_event(Event::UnsupportedVersion(id)),
@@ -144,7 +148,11 @@ impl<T: Config> DmpMessageHandler for LimitAndDropDmpExecution<T> {
 		let mut used = 0;
 		for (_sent_at, data) in iter {
 			let id = sp_io::hashing::twox_64(&data[..]);
-			let msg = VersionedXcm::<T::Call>::decode(&mut &data[..]).map(Xcm::<T::Call>::try_from);
+			let msg = VersionedXcm::<T::Call>::decode_all_with_depth_limit(
+				MAX_XCM_DECODE_DEPTH,
+				&mut &data[..],
+			)
+			.map(Xcm::<T::Call>::try_from);
 			match msg {
 				Err(_) => Pallet::<T>::deposit_event(Event::InvalidFormat(id)),
 				Ok(Err(())) => Pallet::<T>::deposit_event(Event::UnsupportedVersion(id)),

pallets/xcmp-queue/Cargo.toml

@@ -6,10 +6,10 @@ edition = "2018"
 
 [dependencies]
 # Other dependencies
-codec = { package = "parity-scale-codec", version = "2.0.0", features = [ "derive" ], default-features = false }
+codec = { package = "parity-scale-codec", version = "2.3.0", features = [ "derive" ], default-features = false }
+rand_chacha = { version = "0.3.0", default-features = false }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 log = { version = "0.4.14", default-features = false }
-rand_chacha = { version = "0.3.0", default-features = false }
 
 # Substrate Dependencies
 sp-std = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }

pallets/xcmp-queue/src/lib.rs

@@ -31,7 +31,7 @@ mod mock;
 #[cfg(test)]
 mod tests;
 
-use codec::{Decode, Encode};
+use codec::{Decode, DecodeAll, DecodeLimit, Encode};
 use cumulus_primitives_core::{
 	relay_chain::BlockNumber as RelayBlockNumber, ChannelStatus, GetChannelInfo, MessageSendError,
 	ParaId, XcmpMessageFormat, XcmpMessageHandler, XcmpMessageSource,
@@ -44,7 +44,7 @@ use rand_chacha::{
 use scale_info::TypeInfo;
 use sp_runtime::{traits::Hash, RuntimeDebug};
 use sp_std::{convert::TryFrom, prelude::*};
-use xcm::{latest::prelude::*, VersionedXcm, WrapVersion};
+use xcm::{latest::prelude::*, VersionedXcm, WrapVersion, MAX_XCM_DECODE_DEPTH};
 
 pub use pallet::*;
 
@@ -249,7 +249,11 @@ impl<T: Config> Pallet<T> {
 		let have_active = s[index].4 > s[index].3;
 		let appended = have_active &&
 			<OutboundXcmpMessages<T>>::mutate(recipient, s[index].4 - 1, |s| {
-				if XcmpMessageFormat::decode(&mut &s[..]) != Ok(format) {
+				if XcmpMessageFormat::decode_and_advance_with_depth_limit(
+					MAX_XCM_DECODE_DEPTH,
+					&mut &s[..],
+				) != Ok(format)
+				{
 					return false
 				}
 				if s.len() + data.len() > max_message_size {
@@ -371,7 +375,10 @@ impl<T: Config> Pallet<T> {
 			XcmpMessageFormat::ConcatenatedVersionedXcm => {
 				while !remaining_fragments.is_empty() {
 					last_remaining_fragments = remaining_fragments;
-					if let Ok(xcm) = VersionedXcm::<T::Call>::decode(&mut remaining_fragments) {
+					if let Ok(xcm) = VersionedXcm::<T::Call>::decode_and_advance_with_depth_limit(
+						MAX_XCM_DECODE_DEPTH,
+						&mut remaining_fragments,
+					) {
 						let weight = max_weight - weight_used;
 						match Self::handle_xcm_message(sender, sent_at, xcm, weight) {
 							Ok(used) => weight_used = weight_used.saturating_add(used),
@@ -394,7 +401,7 @@ impl<T: Config> Pallet<T> {
 			XcmpMessageFormat::ConcatenatedEncodedBlob => {
 				while !remaining_fragments.is_empty() {
 					last_remaining_fragments = remaining_fragments;
-					if let Ok(blob) = <Vec<u8>>::decode(&mut remaining_fragments) {
+					if let Ok(blob) = <Vec<u8>>::decode_all(&mut remaining_fragments) {
 						let weight = max_weight - weight_used;
 						match Self::handle_blob_message(sender, sent_at, blob, weight) {
 							Ok(used) => weight_used = weight_used.saturating_add(used),
@@ -588,7 +595,10 @@ impl<T: Config> XcmpMessageHandler for Pallet<T> {
 		for (sender, sent_at, data) in iter {
 			// Figure out the message format.
 			let mut data_ref = data;
-			let format = match XcmpMessageFormat::decode(&mut data_ref) {
+			let format = match XcmpMessageFormat::decode_and_advance_with_depth_limit(
+				MAX_XCM_DECODE_DEPTH,
+				&mut data_ref,
+			) {
 				Ok(f) => f,
 				Err(_) => {
 					debug_assert!(false, "Unknown XCMP message format. Silently dropping message");

polkadot-parachains/Cargo.toml

@@ -12,7 +12,7 @@ path = "src/main.rs"
 [dependencies]
 futures = { version = "0.3.1", features = ["compat"] }
 log = "0.4.8"
-codec = { package = "parity-scale-codec", version = "2.0.0" }
+codec = { package = "parity-scale-codec", version = "2.3.0" }
 structopt = "0.3.3"
 serde = { version = "1.0.101", features = ["derive"] }
 hex-literal = "0.2.1"

polkadot-parachains/pallets/parachain-info/Cargo.toml

@@ -5,7 +5,7 @@ name = "parachain-info"
 version = "0.1.0"
 
 [dependencies]
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"] }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 serde = { version = "1.0.101", optional = true, features = ["derive"] }
 

polkadot-parachains/pallets/ping/Cargo.toml

@@ -5,7 +5,7 @@ name = "cumulus-ping"
 version = "0.1.0"
 
 [dependencies]
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"] }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 serde = { version = "1.0.101", optional = true, features = ["derive"] }
 

polkadot-parachains/parachains-common/Cargo.toml

@@ -10,7 +10,7 @@ targets = ['x86_64-unknown-linux-gnu']
 
 [dependencies]
 # External dependencies
-codec = { package = 'parity-scale-codec', version = '2.0.0', features = ['derive'], default-features = false }
+codec = { package = 'parity-scale-codec', version = '2.3.0', features = ['derive'], default-features = false }
 scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 
 # Substrate dependencies

polkadot-parachains/rococo/Cargo.toml

@@ -6,11 +6,11 @@ edition = '2018'
 description = "Simple runtime used by the rococo parachain(s)"
 
 [dependencies]
-serde = { version = "1.0.101", optional = true, features = ["derive"] }
-scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"] }
 log = { version = "0.4.14", default-features = false }
 parachain-info = { path = "../pallets/parachain-info", default-features = false }
+scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
 
 # Substrate dependencies
 sp-std = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }

polkadot-parachains/shell/Cargo.toml

@@ -5,11 +5,11 @@ authors = ["Parity Technologies <admin@parity.io>"]
 edition = '2018'
 
 [dependencies]
-serde = { version = "1.0.101", optional = true, features = ["derive"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive"] }
-scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive"] }
 log = { version = "0.4.14", default-features = false }
 parachain-info = { path = "../pallets/parachain-info", default-features = false }
+scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
 
 # Substrate dependencies
 sp-std = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }

polkadot-parachains/statemine/Cargo.toml

@@ -6,13 +6,13 @@ edition = '2018'
 description = "Kusama variant of Statemint parachain runtime"
 
 [dependencies]
-serde = { version = "1.0.101", optional = true, features = ["derive"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive", "max-encoded-len"] }
-scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive", "max-encoded-len"] }
+hex-literal = { version = '0.3.1', optional = true }
 log = { version = "0.4.14", default-features = false }
 parachain-info = { path = "../pallets/parachain-info", default-features = false }
+scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
 smallvec = "1.6.1"
-hex-literal = { version = '0.3.1', optional = true }
 
 # Substrate dependencies
 sp-std = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }

polkadot-parachains/statemint/Cargo.toml

@@ -6,13 +6,13 @@ edition = '2018'
 description = "Statemint parachain runtime"
 
 [dependencies]
-serde = { version = "1.0.101", optional = true, features = ["derive"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive", "max-encoded-len"] }
-scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive", "max-encoded-len"] }
+hex-literal = { version = '0.3.1', optional = true }
 log = { version = "0.4.14", default-features = false }
 parachain-info = { path = "../pallets/parachain-info", default-features = false }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
 smallvec = "1.6.1"
-hex-literal = { version = '0.3.1', optional = true }
 
 # Substrate dependencies
 sp-std = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }

polkadot-parachains/westmint/Cargo.toml

@@ -6,13 +6,13 @@ edition = '2018'
 description = "Westend variant of Statemint parachain runtime"
 
 [dependencies]
-serde = { version = "1.0.101", optional = true, features = ["derive"] }
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = ["derive", "max-encoded-len"] }
-scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = ["derive", "max-encoded-len"] }
+hex-literal = { version = '0.3.1', optional = true }
 log = { version = "0.4.14", default-features = false }
 parachain-info = { path = "../pallets/parachain-info", default-features = false }
+scale-info = { version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
 smallvec = "1.6.1"
-hex-literal = { version = '0.3.1', optional = true }
 
 # Substrate dependencies
 sp-std = { git = "https://github.com/paritytech/substrate", default-features = false, branch = "master" }

primitives/core/Cargo.toml

@@ -19,7 +19,7 @@ polkadot-core-primitives = { git = "https://github.com/paritytech/polkadot", def
 
 # Other dependencies
 impl-trait-for-tuples = "0.2.1"
-codec = { package = "parity-scale-codec", version = "2.0.0", default-features = false, features = [ "derive" ] }
+codec = { package = "parity-scale-codec", version = "2.3.0", default-features = false, features = [ "derive" ] }
 
 [features]
 default = [ "std" ]