Added Oversized Response Guard and goroutine defer wrap

Signed-off-by: Effi-S <effi.szt@gmail.com>

Author: Effi-S

token/services/network/fabric/lookup/deliveryqs.go

@@ -66,7 +66,18 @@ func (q *DeliveryScanQueryByID) QueryByID(ctx context.Context, startingBlock dri
 	// Keys are supposed to be unique
 	keys := collections.Keys(evicted) // These are the state keys we are looking for
 	ch := make(chan []KeyInfo, len(keys))
-	go q.queryByID(ctx, keys, ch, startingBlock, evicted)
+
+	go func() {
+		// Defense in depth: any unforeseen panic in this background path must degrade to a
+		// failed request rather than crashing the whole node process, since nothing else in
+		// this goroutine's call chain has a recover().
+		defer func() {
+			if r := recover(); r != nil {
+				logger.Errorf("recovered from panic in queryByID: %v", r)
+			}
+		}()
+		q.queryByID(ctx, keys, ch, startingBlock, evicted)
+	}()
 
 	return ch, nil
 }
@@ -117,6 +128,13 @@ func (q *DeliveryScanQueryByID) queryByID(ctx context.Context, keys []driver.PKe
 
 			continue
 		}
+		if len(values) != len(keys) {
+			logger.Errorf("peer returned %d values for %d keys in ns [%s]; falling back to block scan",
+				len(values), len(keys), ns)
+			startDelivery = true
+
+			continue // treat as a per-namespace failure (=> fall back to the slow block scan)
+		}
 		found := make([]KeyInfo, 0, len(values))
 		var notFound []string
 		for i, value := range values {

token/services/network/fabric/lookup/deliveryqs_test.go

@@ -194,6 +194,25 @@ func TestQueryByID_MissingValueTriggersScan(t *testing.T) {
 	assert.True(t, scanner.called)
 }
 
+// A peer that returns more values than keys requested
+// must not index the keys slice out of range and crash the process.
+// (From Issue #2055.)
+func TestQueryByID_OversizedResponse(t *testing.T) {
+	// 2 values returned, but only 1 key requested.
+	querier := &fakeQuerier{results: map[driver.Namespace]querierResult{
+		"ns1": {raw: values(t, []byte("v1"), []byte("v2-unexpected"))},
+	}}
+	scanner := &fakeScanner{}
+
+	ch, err := newQuery(querier, scanner).QueryByID(t.Context(), 100, evictedFor(map[driver.Namespace]driver.PKey{
+		"ns1": "k1",
+	}))
+	require.NoError(t, err)
+
+	// Nothing is delivered for the oversized namespace.
+	// It should fall back to the block scan rather than crashing.
+	assert.Empty(t, drain(ch))
+	assert.True(t, scanner.called, "the oversized response must fall back to the block scan")
 // The fallback block scan must never start from an underflowed block number: on a chain younger
 // than NumberPastBlocks it starts from FirstBlock instead of wrapping around to a block near
 // MaxUint64, which would silently find nothing and surface no error.