miniscript: check thresh bounds when parsing a script

darosior · darosior · commit c1917c3f2d38 · 2021-09-26T12:44:40.000+02:00
The check was dropped in 4085ffc Signed-off-by: Antoine Poinsot <darosior@protonmail.com>
diff --git a/bitcoin/script/miniscript.h b/bitcoin/script/miniscript.h
@@ -1338,6 +1338,7 @@ inline NodeRef<Key> DecodeScript(I& in, I last, const Ctx& ctx) {
             break;
         }
         case DecodeContext::THRESH_E: {
+            if (k < 1 || k > n) return {};
             std::vector<NodeRef<Key>> subs;
             for (int i = 0; i < n; ++i) {
                 NodeRef<Key> sub = std::move(constructed.back());

Original file line number	Diff line number	Diff line change
`@@ -1338,6 +1338,7 @@ inline NodeRef<Key> DecodeScript(I& in, I last, const Ctx& ctx) {`
`1338`	`1338`	`break;`
`1339`	`1339`	`}`
`1340`	`1340`	`case DecodeContext::THRESH_E: {`
	`1341`	`+ if (k < 1 \|\| k > n) return {};`
`1341`	`1342`	`std::vector<NodeRef<Key>> subs;`
`1342`	`1343`	`for (int i = 0; i < n; ++i) {`
`1343`	`1344`	`NodeRef<Key> sub = std::move(constructed.back());`