Anchor IDL parser panic on malformed generic type strings (DoS)

Repo: https://github.com/solana-foundation/anchor

Component: anchor-lang-idl-spec (IDL type-string parser)

Fixed by: https://github.com/yukikm/anchor/commit/d5fd3eb4d7cc9c8d3e4b0f5aeb2c28d5bb1b1b43
(branch: fix-idl-defined-generics-parser-dos)

Summary

IdlType::from_str could panic when parsing malformed “defined type” strings with generics, due to unwrap() calls on missing slices / missing closing >.

This is a denial-of-service class issue for any tooling that parses IDLs or type strings and treats panics as fatal (e.g., build tooling / codegen / CI pipelines). A malicious or corrupted IDL/type string could crash the process instead of returning a structured error.

Impact

  • Availability risk: a single malformed type string can crash the parser process.
  • Developer tooling / CI disruption: panics terminate the entire build/codegen run rather than returning a useful error.

No on-chain funds are directly at risk (this is off-chain tooling), but it can be used to break build pipelines or automated IDL ingestion.

Affected code

In idl/spec/src/lib.rs, within impl FromStr for IdlType, the “Defined” branch parsed generics like:

let (name, generics) = if let Some(i) = s.find('<') {
  (
    s.get(..i).unwrap().to_owned(),
    s.get(i + 1..)
      .unwrap()
      .strip_suffix('>')
      .unwrap()
      .split(',')
      ...
  )
} else {
  (s.to_owned(), vec![])
};

Why it panicked

  • strip_suffix('>').unwrap() panics if the string is missing the closing >.
    • Example: "MyStruct<Pubkey"
  • Empty-generic cases (e.g. "MyStruct<>") also flowed into split(',') and could lead to confusing behavior; the fix makes this an explicit error.

Proof of concept / reproduction

Run this snippet against the vulnerable version:

1
2
3
4
5
6
7
use anchor_lang_idl_spec::IdlType;
use std::str::FromStr;

fn main() {
    // Missing closing '>'
    let _ = IdlType::from_str("MyStruct<Pubkey");
}

Expected behavior

Return Err(...) describing invalid generic syntax.

Actual behavior (pre-fix)

Process panics (DoS).

Fix

The fix replaces unwrap() calls with error-returning parsing:

  • If the closing > is missing → return Err(anyhow!(...))
  • If the generic list is empty or contains empty items → return Err(anyhow!(...))

Commit: d5fd3eb
Diff: https://github.com/yukikm/anchor/commit/d5fd3eb4d7cc9c8d3e4b0f5aeb2c28d5bb1b1b43

Verification

New tests were added to ensure malformed inputs return Err and do not panic:

  • IdlType::from_str("MyStruct<Pubkey")Err
  • IdlType::from_str("MyStruct<>")Err

To verify locally:

cargo test -p anchor-lang-idl-spec

PR

Create PR from fork branch:

Notes

  • This is consistent with prior hardening in the same parser where malformed array types were changed from panics to structured errors.
  • The approach is intentionally minimal-scope: it only changes malformed generic parsing to return errors rather than panicking.
Edit

Pub: 15 Feb 2026 21:19 UTC

Views: 34