wallet: Check utxo prevout index out of bounds in sendall

achow101 · fanquake · commit dedee6af5724 · 2022-10-28T17:59:30.000+08:00
Github-Pull: #26344 Rebased-From: b132c85
diff --git a/src/wallet/rpc/spend.cpp b/src/wallet/rpc/spend.cpp
@@ -1380,7 +1380,7 @@ RPCHelpMan sendall()
                         throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Input not available. UTXO (%s:%d) was already spent.", input.prevout.hash.ToString(), input.prevout.n));
                     }
                     const CWalletTx* tx{pwallet->GetWalletTx(input.prevout.hash)};
-                    if (!tx || !(pwallet->IsMine(tx->tx->vout[input.prevout.n]) & (coin_control.fAllowWatchOnly ? ISMINE_ALL : ISMINE_SPENDABLE))) {
+                    if (!tx || input.prevout.n >= tx->tx->vout.size() || !(pwallet->IsMine(tx->tx->vout[input.prevout.n]) & (coin_control.fAllowWatchOnly ? ISMINE_ALL : ISMINE_SPENDABLE))) {
                         throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Input not found. UTXO (%s:%d) is not part of wallet.", input.prevout.hash.ToString(), input.prevout.n));
                     }
                     total_input_value += tx->tx->vout[input.prevout.n].nValue;

Original file line number	Diff line number	Diff line change
`@@ -1380,7 +1380,7 @@ RPCHelpMan sendall()`
`1380`	`1380`	`throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Input not available. UTXO (%s:%d) was already spent.", input.prevout.hash.ToString(), input.prevout.n));`
`1381`	`1381`	`}`
`1382`	`1382`	`const CWalletTx* tx{pwallet->GetWalletTx(input.prevout.hash)};`
`1383`		`- if (!tx \|\| !(pwallet->IsMine(tx->tx->vout[input.prevout.n]) & (coin_control.fAllowWatchOnly ? ISMINE_ALL : ISMINE_SPENDABLE))) {`
	`1383`	`+ if (!tx \|\| input.prevout.n >= tx->tx->vout.size() \|\| !(pwallet->IsMine(tx->tx->vout[input.prevout.n]) & (coin_control.fAllowWatchOnly ? ISMINE_ALL : ISMINE_SPENDABLE))) {`
`1384`	`1384`	`throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Input not found. UTXO (%s:%d) is not part of wallet.", input.prevout.hash.ToString(), input.prevout.n));`
`1385`	`1385`	`}`
`1386`	`1386`	`total_input_value += tx->tx->vout[input.prevout.n].nValue;`