@@ -451,10 +451,16 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
451451 if (opcode > OP_16 && ++nOpCount > MAX_OPS_PER_SCRIPT) {
452452 return set_error (serror, SCRIPT_ERR_OP_COUNT);
453453 }
454+
455+ // When OP_SUCCESS disabled opcodes (CVE-2010-5137) are
456+ // redefined in tapscript, remove them from the if below
457+ // and put them here
458+ if (opcode == OP_CAT) {
459+ return set_error (serror, SCRIPT_ERR_DISABLED_OPCODE); // Disabled opcodes (CVE-2010-5137).
460+ }
454461 }
455462
456- if (opcode == OP_CAT ||
457- opcode == OP_SUBSTR ||
463+ if (opcode == OP_SUBSTR ||
458464 opcode == OP_LEFT ||
459465 opcode == OP_RIGHT ||
460466 opcode == OP_INVERT ||
@@ -518,6 +524,19 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
518524 case OP_NOP:
519525 break ;
520526
527+ case OP_CAT:
528+ {
529+ if (stack.size () < 2 )
530+ return set_error (serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
531+ valtype& vch1 = stacktop (-2 );
532+ valtype& vch2 = stacktop (-1 );
533+ if (vch1.size () + vch2.size () > MAX_SCRIPT_ELEMENT_SIZE)
534+ return set_error (serror, SCRIPT_ERR_PUSH_SIZE);
535+ vch1.insert (vch1.end (), vch2.begin (), vch2.end ());
536+ stack.pop_back ();
537+ }
538+ break ;
539+
521540 case OP_CHECKLOCKTIMEVERIFY:
522541 {
523542 if (!(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY)) {
@@ -1807,10 +1826,19 @@ static bool ExecuteWitnessScript(const Span<const valtype>& stack_span, const CS
18071826 }
18081827 // New opcodes will be listed here. May use a different sigversion to modify existing opcodes.
18091828 if (IsOpSuccess (opcode)) {
1810- if (flags & SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS) {
1811- return set_error (serror, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
1829+ if (opcode == OP_CAT) {
1830+ if (flags & SCRIPT_VERIFY_DISCOURAGE_OP_CAT) {
1831+ return set_error (serror, SCRIPT_ERR_DISCOURAGE_OP_CAT);
1832+ } else if (!(flags & SCRIPT_VERIFY_OP_CAT)) {
1833+ return set_success (serror);
1834+ }
1835+ } else {
1836+ // OP_SUCCESS behaviour
1837+ if (flags & SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS) {
1838+ return set_error (serror, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
1839+ }
1840+ return set_success (serror);
18121841 }
1813- return set_success (serror);
18141842 }
18151843 }
18161844
0 commit comments