HomePhabricator

wallet: Check size after unserializing a pubkey

Description

wallet: Check size after unserializing a pubkey

Summary:

Currently all the public API(except the pointer-like API) in CPubKey that sets/constructs a pubkey goes through CPubKey::Set which checks if that the length and size match and if not invalidates the key.

This adds the same check to CPubKey::Unserialize, sadly I don't see an easy way to just push this to the existing checks in CPubKey::Set but it's only a simple condition.

The problem with not invalidating is that if you write a pubkey like: {0x02,0x00} it will think the actual length is 33(because of size()) and will access uninitialized memory if you call any of the functions on CPubKey.

This is a backport of core#19237

Test Plan: ninja check

Reviewers: #bitcoin_abc, majcosta

Reviewed By: #bitcoin_abc, majcosta

Differential Revision: https://reviews.bitcoinabc.org/D9954

Details

Provenance
Elichai Turkel <elichai.turkel@gmail.com>Authored on Jun 10 2020, 14:34
PiRKCommitted on Aug 27 2021, 06:46
PiRKPushed on Aug 27 2021, 06:46
Reviewer
Restricted Project
Differential Revision
D9954: wallet: Check size after unserializing a pubkey
Parents
rABC85fc832df28d: doc: add release note for bitcoin-cli -generate
Branches
Unknown
Tags
Unknown