Skip to content

rpc: signed-integer-overflow in analyzepsbt["estimated_feerate"] #27913

@maflcko

Description

@maflcko

Is there an existing issue for this?

  • I have searched the existing issues

Current behaviour

crash/UB in

result.pushKV("estimated_feerate", ValueFromAmount(psbta.estimated_feerate->GetFeePerK()));

Expected behaviour

no crash

Steps to reproduce

  • Compile with ubsan
  • UBSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1" ./src/qt/bitcoin-qt
  • analyzepsbt cHNidP8BACkgICAgAAEgICAgIP8DABYgICAgICAgICAgICAgICAgICAgICAgICAgIAAA

Relevant log output

    #0 0x55a94d97befd in CFeeRate::GetFee(unsigned int) const src/policy/feerate.cpp:29:63
    #1 0x55a94d4648ca in CFeeRate::GetFeePerK() const src/./policy/feerate.h:65:41
    #2 0x55a94d4648ca in analyzepsbt()::$_13::operator()(RPCHelpMan const&, JSONRPCRequest const&) const src/rpc/rawtransaction.cpp:1907:85
...
SUMMARY: UndefinedBehaviorSanitizer: signed-integer-overflow policy/feerate.cpp:29:63 in 

How did you obtain Bitcoin Core

Compiled from source

What version of Bitcoin Core are you using?

current master

Operating system and version

Linux

Machine specifications

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions