Skip to content

Commit 9ab14e4

Browse files
author
pierrenn
committed
Limit decimal range of numbers ParseScript accepts
1 parent 97b0687 commit 9ab14e4

File tree

8 files changed

+63
-17
lines changed

8 files changed

+63
-17
lines changed

‎Makefile.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,8 @@ EXTRA_DIST += \
301301
test/util/data/txcreatescript3.json \
302302
test/util/data/txcreatescript4.hex \
303303
test/util/data/txcreatescript4.json \
304+
test/util/data/txcreatescript5.hex \
305+
test/util/data/txcreatescript6.hex \
304306
test/util/data/txcreatesignv1.hex \
305307
test/util/data/txcreatesignv1.json \
306308
test/util/data/txcreatesignv2.hex \

‎src/core_read.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ CScript ParseScript(const std::string& s)
5959
{
6060
// Number
6161
int64_t n = atoi64(*w);
62+
63+
//limit the range of numbers ParseScript accepts in decimal
64+
//since numbers outside -0xFFFFFFFF...0xFFFFFFFF are illegal in scripts
65+
if (n > int64_t{0xffffffff} || n < -1 * int64_t{0xffffffff}) {
66+
throw std::runtime_error("script parse error: decimal numeric value only allowed in the "
67+
"range -0xFFFFFFFF...0xFFFFFFFF");
68+
}
69+
6270
result << n;
6371
}
6472
else if (w->substr(0,2) == "0x" && w->size() > 2 && IsHex(std::string(w->begin()+2, w->end())))

‎src/test/data/script_tests.json‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -121,9 +121,9 @@
121121
["8388608", "SIZE 4 EQUAL", "P2SH,STRICTENC", "OK"],
122122
["2147483647", "SIZE 4 EQUAL", "P2SH,STRICTENC", "OK"],
123123
["2147483648", "SIZE 5 EQUAL", "P2SH,STRICTENC", "OK"],
124-
["549755813887", "SIZE 5 EQUAL", "P2SH,STRICTENC", "OK"],
125-
["549755813888", "SIZE 6 EQUAL", "P2SH,STRICTENC", "OK"],
126-
["9223372036854775807", "SIZE 8 EQUAL", "P2SH,STRICTENC", "OK"],
124+
["0x05ffffffff7f", "SIZE 5 EQUAL", "P2SH,STRICTENC", "OK"],
125+
["0x06000000008000", "SIZE 6 EQUAL", "P2SH,STRICTENC", "OK"],
126+
["0x08ffffffffffffff7f", "SIZE 8 EQUAL", "P2SH,STRICTENC", "OK"],
127127
["-1", "SIZE 1 EQUAL", "P2SH,STRICTENC", "OK"],
128128
["-127", "SIZE 1 EQUAL", "P2SH,STRICTENC", "OK"],
129129
["-128", "SIZE 2 EQUAL", "P2SH,STRICTENC", "OK"],
@@ -133,9 +133,9 @@
133133
["-8388608", "SIZE 4 EQUAL", "P2SH,STRICTENC", "OK"],
134134
["-2147483647", "SIZE 4 EQUAL", "P2SH,STRICTENC", "OK"],
135135
["-2147483648", "SIZE 5 EQUAL", "P2SH,STRICTENC", "OK"],
136-
["-549755813887", "SIZE 5 EQUAL", "P2SH,STRICTENC", "OK"],
137-
["-549755813888", "SIZE 6 EQUAL", "P2SH,STRICTENC", "OK"],
138-
["-9223372036854775807", "SIZE 8 EQUAL", "P2SH,STRICTENC", "OK"],
136+
["0x05ffffffffff", "SIZE 5 EQUAL", "P2SH,STRICTENC", "OK"],
137+
["0x06000000008080", "SIZE 6 EQUAL", "P2SH,STRICTENC", "OK"],
138+
["0x08ffffffffffffffff", "SIZE 8 EQUAL", "P2SH,STRICTENC", "OK"],
139139
["'abcdefghijklmnopqrstuvwxyz'", "SIZE 26 EQUAL", "P2SH,STRICTENC", "OK"],
140140

141141
["42", "SIZE 1 EQUALVERIFY 42 EQUAL", "P2SH,STRICTENC", "OK", "SIZE does not consume argument"],
@@ -360,9 +360,9 @@
360360
["8388608", "0x04 0x00008000 EQUAL", "P2SH,STRICTENC", "OK"],
361361
["2147483647", "0x04 0xFFFFFF7F EQUAL", "P2SH,STRICTENC", "OK"],
362362
["2147483648", "0x05 0x0000008000 EQUAL", "P2SH,STRICTENC", "OK"],
363-
["549755813887", "0x05 0xFFFFFFFF7F EQUAL", "P2SH,STRICTENC", "OK"],
364-
["549755813888", "0x06 0x000000008000 EQUAL", "P2SH,STRICTENC", "OK"],
365-
["9223372036854775807", "0x08 0xFFFFFFFFFFFFFF7F EQUAL", "P2SH,STRICTENC", "OK"],
363+
["0x05ffffffff7f", "0x05 0xFFFFFFFF7F EQUAL", "P2SH,STRICTENC", "OK"],
364+
["0x06000000008000", "0x06 0x000000008000 EQUAL", "P2SH,STRICTENC", "OK"],
365+
["0x08ffffffffffffff7f", "0x08 0xFFFFFFFFFFFFFF7F EQUAL", "P2SH,STRICTENC", "OK"],
366366
["-1", "0x01 0x81 EQUAL", "P2SH,STRICTENC", "OK", "Numbers are little-endian with the MSB being a sign bit"],
367367
["-127", "0x01 0xFF EQUAL", "P2SH,STRICTENC", "OK"],
368368
["-128", "0x02 0x8080 EQUAL", "P2SH,STRICTENC", "OK"],
@@ -373,9 +373,9 @@
373373
["-2147483647", "0x04 0xFFFFFFFF EQUAL", "P2SH,STRICTENC", "OK"],
374374
["-2147483648", "0x05 0x0000008080 EQUAL", "P2SH,STRICTENC", "OK"],
375375
["-4294967295", "0x05 0xFFFFFFFF80 EQUAL", "P2SH,STRICTENC", "OK"],
376-
["-549755813887", "0x05 0xFFFFFFFFFF EQUAL", "P2SH,STRICTENC", "OK"],
377-
["-549755813888", "0x06 0x000000008080 EQUAL", "P2SH,STRICTENC", "OK"],
378-
["-9223372036854775807", "0x08 0xFFFFFFFFFFFFFFFF EQUAL", "P2SH,STRICTENC", "OK"],
376+
["0x05ffffffffff", "0x05 0xFFFFFFFFFF EQUAL", "P2SH,STRICTENC", "OK"],
377+
["0x06000000008080", "0x06 0x000000008080 EQUAL", "P2SH,STRICTENC", "OK"],
378+
["0x08ffffffffffffffff", "0x08 0xFFFFFFFFFFFFFFFF EQUAL", "P2SH,STRICTENC", "OK"],
379379

380380
["2147483647", "1ADD 2147483648 EQUAL", "P2SH,STRICTENC", "OK", "We can do math on 4-byte integers, and compare 5-byte ones"],
381381
["2147483647", "1ADD 1", "P2SH,STRICTENC", "OK"],
@@ -2521,7 +2521,7 @@
25212521
["-1", "CHECKSEQUENCEVERIFY", "CHECKSEQUENCEVERIFY", "NEGATIVE_LOCKTIME", "CSV automatically fails if stack top is negative"],
25222522
["0x0100", "CHECKSEQUENCEVERIFY", "CHECKSEQUENCEVERIFY,MINIMALDATA", "UNKNOWN_ERROR", "CSV fails if stack top is not minimally encoded"],
25232523
["0", "CHECKSEQUENCEVERIFY", "CHECKSEQUENCEVERIFY", "UNSATISFIED_LOCKTIME", "CSV fails if stack top bit 1 << 31 is set and the tx version < 2"],
2524-
["4294967296", "CHECKSEQUENCEVERIFY", "CHECKSEQUENCEVERIFY", "UNSATISFIED_LOCKTIME",
2524+
["0x050000000001", "CHECKSEQUENCEVERIFY", "CHECKSEQUENCEVERIFY", "UNSATISFIED_LOCKTIME",
25252525
"CSV fails if stack top bit 1 << 31 is not set, and tx version < 2"],
25262526

25272527
["MINIMALIF tests"],

‎src/test/data/tx_invalid.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@
174174
"0100000001000100000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000ff64cd1d", "P2SH,CHECKLOCKTIMEVERIFY"],
175175

176176
["Argument 2^32 with nLockTime=2^32-1"],
177-
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "4294967296 CHECKLOCKTIMEVERIFY 1"]],
177+
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "0x050000000001 CHECKLOCKTIMEVERIFY 1"]],
178178
"0100000001000100000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000ffffffff", "P2SH,CHECKLOCKTIMEVERIFY"],
179179

180180
["Same, but with nLockTime=2^31-1"],

‎src/test/data/tx_valid.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -292,11 +292,11 @@
292292
"020000000100010000000000000000000000000000000000000000000000000000000000000000000000ffffffff0100000000000000000000000000", "P2SH,CHECKSEQUENCEVERIFY"],
293293

294294
["Argument 3<<31 with various nSequence"],
295-
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "6442450944 CHECKSEQUENCEVERIFY 1"]],
295+
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "0x050000008001 CHECKSEQUENCEVERIFY 1"]],
296296
"020000000100010000000000000000000000000000000000000000000000000000000000000000000000ffffbf7f0100000000000000000000000000", "P2SH,CHECKSEQUENCEVERIFY"],
297-
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "6442450944 CHECKSEQUENCEVERIFY 1"]],
297+
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "0x050000008001 CHECKSEQUENCEVERIFY 1"]],
298298
"020000000100010000000000000000000000000000000000000000000000000000000000000000000000ffffff7f0100000000000000000000000000", "P2SH,CHECKSEQUENCEVERIFY"],
299-
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "6442450944 CHECKSEQUENCEVERIFY 1"]],
299+
[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "0x050000008001 CHECKSEQUENCEVERIFY 1"]],
300300
"020000000100010000000000000000000000000000000000000000000000000000000000000000000000ffffffff0100000000000000000000000000", "P2SH,CHECKSEQUENCEVERIFY"],
301301

302302
["5 byte non-minimally-encoded operandss are valid"],

‎test/util/data/bitcoin-util-test.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,40 @@
258258
"output_cmp": "txcreatescript4.json",
259259
"description": "Create a new transaction with a single output script (OP_DROP) in a P2SH, wrapped in a P2SH (output as json)"
260260
},
261+
{ "exec": "./bitcoin-tx",
262+
"args": ["-create", "outscript=0:9999999999"],
263+
"return_code": 1,
264+
"error_txt": "error: script parse error: decimal numeric value only allowed in the range -0xFFFFFFFF...0xFFFFFFFF",
265+
"description": "Try to parse an output script with a decimal number above the allowed range"
266+
},
267+
{ "exec": "./bitcoin-tx",
268+
"args": ["-create", "outscript=0:4294967296"],
269+
"return_code": 1,
270+
"error_txt": "error: script parse error: decimal numeric value only allowed in the range -0xFFFFFFFF...0xFFFFFFFF",
271+
"description": "Try to parse an output script with a decimal number just above the allowed range"
272+
},
273+
{ "exec": "./bitcoin-tx",
274+
"args": ["-create", "outscript=0:4294967295"],
275+
"output_cmp": "txcreatescript5.hex",
276+
"description": "Try to parse an output script with a decimal number at the upper limit of the allowed range"
277+
},
278+
{ "exec": "./bitcoin-tx",
279+
"args": ["-create", "outscript=0:-9999999999"],
280+
"return_code": 1,
281+
"error_txt": "error: script parse error: decimal numeric value only allowed in the range -0xFFFFFFFF...0xFFFFFFFF",
282+
"description": "Try to parse an output script with a decimal number below the allowed range"
283+
},
284+
{ "exec": "./bitcoin-tx",
285+
"args": ["-create", "outscript=0:-4294967296"],
286+
"return_code": 1,
287+
"error_txt": "error: script parse error: decimal numeric value only allowed in the range -0xFFFFFFFF...0xFFFFFFFF",
288+
"description": "Try to parse an output script with a decimal number just below the allowed range"
289+
},
290+
{ "exec": "./bitcoin-tx",
291+
"args": ["-create", "outscript=0:-4294967295"],
292+
"output_cmp": "txcreatescript6.hex",
293+
"description": "Try to parse an output script with a decimal number at the lower limit of the allowed range"
294+
},
261295
{ "exec": "./bitcoin-tx",
262296
"args":
263297
["-create", "nversion=1",

‎test/util/data/txcreatescript5.hex‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
02000000000100000000000000000605ffffffff0000000000

‎test/util/data/txcreatescript6.hex‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
02000000000100000000000000000605ffffffff8000000000

0 commit comments

Comments
 (0)