core/vm: cap CometBFT light client validator count to prevent DoS

Author: MatusKysel

core/vm/lightclient/v2/lightclient.go

@@ -143,6 +143,9 @@ func DecodeConsensusState(input []byte) (ConsensusState, error) {
 	if inputLen <= minimumLength || (inputLen-minimumLength)%singleValidatorBytesLength != 0 {
 		return ConsensusState{}, fmt.Errorf("expected input size %d+%d*N, actual input size: %d", minimumLength, singleValidatorBytesLength, inputLen)
 	}
+	if inputLen > maxConsensusStateLength {
+		return ConsensusState{}, fmt.Errorf("consensus state too large: %d bytes exceeds maximum %d (max 99 validators)", inputLen, maxConsensusStateLength)
+	}
 
 	pos := uint64(0)
 	chainID := string(bytes.Trim(input[pos:pos+chainIDLength], "\x00"))
@@ -207,6 +210,10 @@ func DecodeLightBlockValidationInput(input []byte) (*ConsensusState, *types.Ligh
 		return nil, nil, fmt.Errorf("integer overflow, csLen: %d", csLen)
 	}
 
+	if csLen > maxConsensusStateLength {
+		return nil, nil, fmt.Errorf("consensus state length %d exceeds maximum %d", csLen, maxConsensusStateLength)
+	}
+
 	if uint64(len(input)) <= consensusStateLengthBytesLength+csLen {
 		return nil, nil, fmt.Errorf("expected payload size %d, actual size: %d", consensusStateLengthBytesLength+csLen, len(input))
 	}