When processing a response from a peer containing a tipset’s messages, the message index BlsIncludes value is incorrectly validated to be in the range of the Bls slice. However, since the message index is controlled by the peer who sent the message, the peer can bypass the validation by setting the index to a value greater than the signed integer max, causing the index to become negative when it is cast to signed. rules : - id : check-int-comparison patterns : - pattern-either : - pattern : | if int($X) >= len($Y) { return ... } - pattern : | if int($X) > len($Y) { return ... } - pattern : | if len($Y) > int($X) { return ... } - pattern : | if len($Y) >= int($X) { return ... } message : | Avoid comparing an integer converted value with the length of a slice.