github.com/ipfs/go-bitfield

When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics.

This happens when the size is a not a multiple of 8 or is negative.

A workaround is to ensure size%8 == 0 && size >= 0 yourself before calling NewBitfield or FromBytes.