From a978cec6e834457d91dc4309fc4d439583faae8b Mon Sep 17 00:00:00 2001
From: Jakub Sztandera <kubuxu@protocol.ai>
Date: Wed, 24 Jun 2020 16:51:38 +0200
Subject: [PATCH] Avoid modifying passed in slice of cids

Signed-off-by: Jakub Sztandera <kubuxu@protocol.ai>
---
 blockservice.go | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/blockservice.go b/blockservice.go
index ba0ab41..9cf96a8 100644
--- a/blockservice.go
+++ b/blockservice.go
@@ -273,17 +273,28 @@ func getBlocks(ctx context.Context, ks []cid.Cid, bs blockstore.Blockstore, fget
 	go func() {
 		defer close(out)
 
-		k := 0
+		allValid := true
 		for _, c := range ks {
-			// hash security
-			if err := verifcid.ValidateCid(c); err == nil {
-				ks[k] = c
-				k++
-			} else {
-				log.Errorf("unsafe CID (%s) passed to blockService.GetBlocks: %s", c, err)
+			if err := verifcid.ValidateCid(c); err != nil {
+				allValid = false
+				break
 			}
 		}
-		ks = ks[:k]
+
+		if !allValid {
+			ks2 := make([]cid.Cid, len(ks))
+			k := 0
+			for _, c := range ks {
+				// hash security
+				if err := verifcid.ValidateCid(c); err == nil {
+					ks2[k] = c
+					k++
+				} else {
+					log.Errorf("unsafe CID (%s) passed to blockService.GetBlocks: %s", c, err)
+				}
+			}
+			ks = ks2[:k]
+		}
 
 		var misses []cid.Cid
 		for _, c := range ks {
-- 
GitLab