CVE-2026-34219 libp2p-rust远程Panic漏洞

// Conceptual Rust PoC demonstrating the logic flaw // This simulates the handling of a malicious PRUNE message leading to overflow. use std::time::{Duration, Instant}; fn main() { // 1. Attacker sends a PRUNE message with a backoff value near Instant::MAX // For demonstration, we simulate the stored value directly. let near_max_backoff = Instant::now() + Duration::from_secs(315360000000); // Far future // 2. Vulnerable code logic in heartbeat processing // The code attempts to add 'slack' to the stored backoff time let slack = Duration::from_secs(60); // This operation causes an arithmetic overflow in Rust // triggering a thread panic. let result = near_max_backoff.checked_add(slack); match result { Some(time) => println!("Next attempt at: {:?}", time), None => { // In the vulnerable version, simple '+' is used causing panic. // panic!("overflow when adding duration to instant"); println!("Simulated Overflow: The vulnerable code would panic here."); } } }