Skip to content

Commit fee0d80

Browse files
committed
Merge #9980: Fix mem access violation merkleblock
8276e70 Adding assert to avoid a memory access violation inside of PartialMerkleTree::CalcHash() (Chris Stewart) Pull request description: Fixing a possible memory access violation in CPartialMerkleTree::CalcHash(). This can happen if we some how a merkle tree with zero txids. I don't think this can happen in practice as we only send merkle block messages on the p2p network as of now -- we cannot receive them. This was found with #8469, specifically using this [generator](https://github.com/Christewart/bitcoin/blob/rapidcheck/src/test/gen/merkleblock_gen.h#L52-L77) which will cause a memory access violation on [this test case](https://github.com/Christewart/bitcoin/blob/rapidcheck/src/test/merkleblock_properties.cpp#L48). Tree-SHA512: b95904ec45ea3f082c7722161d93ee06b24c706fbffa909a6e995ed14788aed2830f91b626da6f0347660c45874a0735dab61c9440b59c949c690af4165c83fb
2 parents 0b01935 + 8276e70 commit fee0d80

File tree

2 files changed

+5
-0
lines changed

2 files changed

+5
-0
lines changed

src/merkleblock.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,9 @@ CMerkleBlock::CMerkleBlock(const CBlock& block, const std::set<uint256>& txids)
5959
}
6060

6161
uint256 CPartialMerkleTree::CalcHash(int height, unsigned int pos, const std::vector<uint256> &vTxid) {
62+
//we can never have zero txs in a merkle block, we always need the coinbase tx
63+
//if we do not have this assert, we can hit a memory access violation when indexing into vTxid
64+
assert(vTxid.size() != 0);
6265
if (height == 0) {
6366
// hash at height 0 is the txids themself
6467
return vTxid[pos];

src/merkleblock.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,8 @@ class CPartialMerkleTree
121121
/**
122122
* Used to relay blocks as header + vector<merkle branch>
123123
* to filtered nodes.
124+
*
125+
* NOTE: The class assumes that the given CBlock has *at least* 1 transaction. If the CBlock has 0 txs, it will hit an assertion.
124126
*/
125127
class CMerkleBlock
126128
{

0 commit comments

Comments
 (0)