Differential D1565 Diff 4315 src/script/interpreter.cpp

Changeset View

Standalone View

src/script/interpreter.cpp

	// Copyright (c) 2009-2010 Satoshi Nakamoto			// Copyright (c) 2009-2010 Satoshi Nakamoto
	// Copyright (c) 2009-2016 The Bitcoin Core developers			// Copyright (c) 2009-2016 The Bitcoin Core developers
				// Copyright (c) 2017-2018 The Bitcoin developers
	// Distributed under the MIT software license, see the accompanying			// Distributed under the MIT software license, see the accompanying
	// file COPYING or http://www.opensource.org/licenses/mit-license.php.			// file COPYING or http://www.opensource.org/licenses/mit-license.php.

	#include "interpreter.h"			#include "interpreter.h"

	#include "crypto/ripemd160.h"			#include "crypto/ripemd160.h"
	#include "crypto/sha1.h"			#include "crypto/sha1.h"
	#include "crypto/sha256.h"			#include "crypto/sha256.h"
	#include "primitives/transaction.h"			#include "primitives/transaction.h"
	#include "pubkey.h"			#include "pubkey.h"
	#include "script/script.h"			#include "script/script.h"
				#include "script/script_flags.h"
				#include "script/sigencoding.h"
	#include "uint256.h"			#include "uint256.h"

	typedef std::vector<uint8_t> valtype;

	namespace {

	inline bool set_success(ScriptError *ret) {
	if (ret) {
	*ret = SCRIPT_ERR_OK;
	}
	return true;
	}

	inline bool set_error(ScriptError *ret, const ScriptError serror) {
	if (ret) {
	*ret = serror;
	}
	return false;
	}

	} // namespace

	bool CastToBool(const valtype &vch) {			bool CastToBool(const valtype &vch) {
	for (size_t i = 0; i < vch.size(); i++) {			for (size_t i = 0; i < vch.size(); i++) {
	if (vch[i] != 0) {			if (vch[i] != 0) {
	// Can be negative zero			// Can be negative zero
	if (i == vch.size() - 1 && vch[i] == 0x80) {			if (i == vch.size() - 1 && vch[i] == 0x80) {
	return false;			return false;
	}			}
	return true;			return true;
	Show All 10 Lines
	#define altstacktop(i) (altstack.at(altstack.size() + (i)))			#define altstacktop(i) (altstack.at(altstack.size() + (i)))
	static inline void popstack(std::vector<valtype> &stack) {			static inline void popstack(std::vector<valtype> &stack) {
	if (stack.empty()) {			if (stack.empty()) {
	throw std::runtime_error("popstack(): stack empty");			throw std::runtime_error("popstack(): stack empty");
	}			}
	stack.pop_back();			stack.pop_back();
	}			}

	static bool IsCompressedOrUncompressedPubKey(const valtype &vchPubKey) {
	if (vchPubKey.size() < 33) {
	// Non-canonical public key: too short
	return false;
	}
	if (vchPubKey[0] == 0x04) {
	if (vchPubKey.size() != 65) {
	// Non-canonical public key: invalid length for uncompressed key
	return false;
	}
	} else if (vchPubKey[0] == 0x02 \|\| vchPubKey[0] == 0x03) {
	if (vchPubKey.size() != 33) {
	// Non-canonical public key: invalid length for compressed key
	return false;
	}
	} else {
	// Non-canonical public key: neither compressed nor uncompressed
	return false;
	}
	return true;
	}

	static bool IsCompressedPubKey(const valtype &vchPubKey) {
	if (vchPubKey.size() != 33) {
	// Non-canonical public key: invalid length for compressed key
	return false;
	}
	if (vchPubKey[0] != 0x02 && vchPubKey[0] != 0x03) {
	// Non-canonical public key: invalid prefix for compressed key
	return false;
	}
	return true;
	}

	/**
	* A canonical signature exists of: <30> <total len> <02> <len R> <R> <02> <len
	* S> <S> <hashtype>, where R and S are not negative (their first byte has its
	* highest bit not set), and not excessively padded (do not start with a 0 byte,
	* unless an otherwise negative number follows, in which case a single 0 byte is
	* necessary and even required).
	*
	* See https://bitcointalk.org/index.php?topic=8392.msg127623#msg127623
	*
	* This function is consensus-critical since BIP66.
	*/
	static bool IsValidSignatureEncoding(const std::vector<uint8_t> &sig) {
	// Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S]
	// [sighash]
	// * total-length: 1-byte length descriptor of everything that follows,
	// excluding the sighash byte.
	// * R-length: 1-byte length descriptor of the R value that follows.
	// * R: arbitrary-length big-endian encoded R value. It must use the
	// shortest possible encoding for a positive integers (which means no null
	// bytes at the start, except a single one when the next byte has its
	// highest bit set).
	// * S-length: 1-byte length descriptor of the S value that follows.
	// * S: arbitrary-length big-endian encoded S value. The same rules apply.
	// * sighash: 1-byte value indicating what data is hashed (not part of the
	// DER signature)

	// Minimum and maximum size constraints.
	if (sig.size() < 9) return false;
	if (sig.size() > 73) return false;

	// A signature is of type 0x30 (compound).
	if (sig[0] != 0x30) return false;

	// Make sure the length covers the entire signature.
	if (sig[1] != sig.size() - 3) return false;

	// Extract the length of the R element.
	unsigned int lenR = sig[3];

	// Make sure the length of the S element is still inside the signature.
	if (5 + lenR >= sig.size()) return false;

	// Extract the length of the S element.
	unsigned int lenS = sig[5 + lenR];

	// Verify that the length of the signature matches the sum of the length
	// of the elements.
	if ((size_t)(lenR + lenS + 7) != sig.size()) return false;

	// Check whether the R element is an integer.
	if (sig[2] != 0x02) return false;

	// Zero-length integers are not allowed for R.
	if (lenR == 0) return false;

	// Negative numbers are not allowed for R.
	if (sig[4] & 0x80) return false;

	// Null bytes at the start of R are not allowed, unless R would otherwise be
	// interpreted as a negative number.
	if (lenR > 1 && (sig[4] == 0x00) && !(sig[5] & 0x80)) return false;

	// Check whether the S element is an integer.
	if (sig[lenR + 4] != 0x02) return false;

	// Zero-length integers are not allowed for S.
	if (lenS == 0) return false;

	// Negative numbers are not allowed for S.
	if (sig[lenR + 6] & 0x80) return false;

	// Null bytes at the start of S are not allowed, unless S would otherwise be
	// interpreted as a negative number.
	if (lenS > 1 && (sig[lenR + 6] == 0x00) && !(sig[lenR + 7] & 0x80)) {
	return false;
	}

	return true;
	}

	static bool IsLowDERSignature(const valtype &vchSig, ScriptError *serror) {
	if (!IsValidSignatureEncoding(vchSig)) {
	return set_error(serror, SCRIPT_ERR_SIG_DER);
	}
	std::vector<uint8_t> vchSigCopy(vchSig.begin(),
	vchSig.begin() + vchSig.size() - 1);
	if (!CPubKey::CheckLowS(vchSigCopy)) {
	return set_error(serror, SCRIPT_ERR_SIG_HIGH_S);
	}
	return true;
	}

	static SigHashType GetHashType(const valtype &vchSig) {
	if (vchSig.size() == 0) {
	return SigHashType(0);
	}

	return SigHashType(vchSig[vchSig.size() - 1]);
	}

	static void CleanupScriptCode(CScript &scriptCode,			static void CleanupScriptCode(CScript &scriptCode,
	const std::vector<uint8_t> &vchSig,			const std::vector<uint8_t> &vchSig,
	uint32_t flags) {			uint32_t flags) {
	// Drop the signature in scripts when SIGHASH_FORKID is not used.			// Drop the signature in scripts when SIGHASH_FORKID is not used.
	SigHashType sigHashType = GetHashType(vchSig);			SigHashType sigHashType = GetHashType(vchSig);
	if (!(flags & SCRIPT_ENABLE_SIGHASH_FORKID) \|\| !sigHashType.hasForkId()) {			if (!(flags & SCRIPT_ENABLE_SIGHASH_FORKID) \|\| !sigHashType.hasForkId()) {
	scriptCode.FindAndDelete(CScript(vchSig));			scriptCode.FindAndDelete(CScript(vchSig));
	}			}
	}			}

	bool CheckSignatureEncoding(const std::vector<uint8_t> &vchSig, uint32_t flags,
	ScriptError *serror) {
	// Empty signature. Not strictly DER encoded, but allowed to provide a
	// compact way to provide an invalid signature for use with CHECK(MULTI)SIG
	if (vchSig.size() == 0) {
	return true;
	}
	if ((flags & (SCRIPT_VERIFY_DERSIG \| SCRIPT_VERIFY_LOW_S \|
	SCRIPT_VERIFY_STRICTENC)) != 0 &&
	!IsValidSignatureEncoding(vchSig)) {
	return set_error(serror, SCRIPT_ERR_SIG_DER);
	}
	if ((flags & SCRIPT_VERIFY_LOW_S) != 0 &&
	!IsLowDERSignature(vchSig, serror)) {
	// serror is set
	return false;
	}
	if ((flags & SCRIPT_VERIFY_STRICTENC) != 0) {
	if (!GetHashType(vchSig).isDefined()) {
	return set_error(serror, SCRIPT_ERR_SIG_HASHTYPE);
	}
	bool usesForkId = GetHashType(vchSig).hasForkId();
	bool forkIdEnabled = flags & SCRIPT_ENABLE_SIGHASH_FORKID;
	if (!forkIdEnabled && usesForkId) {
	return set_error(serror, SCRIPT_ERR_ILLEGAL_FORKID);
	}
	if (forkIdEnabled && !usesForkId) {
	return set_error(serror, SCRIPT_ERR_MUST_USE_FORKID);
	}
	}
	return true;
	}

	static bool CheckPubKeyEncoding(const valtype &vchPubKey, uint32_t flags,
	ScriptError *serror) {
	if ((flags & SCRIPT_VERIFY_STRICTENC) != 0 &&
	!IsCompressedOrUncompressedPubKey(vchPubKey)) {
	return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
	}
	// Only compressed keys are accepted when
	// SCRIPT_VERIFY_COMPRESSED_PUBKEYTYPE is enabled.
	if (flags & SCRIPT_VERIFY_COMPRESSED_PUBKEYTYPE &&
	!IsCompressedPubKey(vchPubKey)) {
	return set_error(serror, SCRIPT_ERR_NONCOMPRESSED_PUBKEY);
	}
	return true;
	}

	static bool CheckMinimalPush(const valtype &data, opcodetype opcode) {			static bool CheckMinimalPush(const valtype &data, opcodetype opcode) {
	if (data.size() == 0) {			if (data.size() == 0) {
	// Could have used OP_0.			// Could have used OP_0.
	return opcode == OP_0;			return opcode == OP_0;
	}			}
	if (data.size() == 1 && data[0] >= 1 && data[0] <= 16) {			if (data.size() == 1 && data[0] >= 1 && data[0] <= 16) {
	// Could have used OP_1 .. OP_16.			// Could have used OP_1 .. OP_16.
	return opcode == OP_1 + (data[0] - 1);			return opcode == OP_1 + (data[0] - 1);
	▲ Show 20 Lines • Show All 1,548 Lines • Show Last 20 Lines