GlcoinCore/btcd
1
0
Fork 0
mirror of https://github.com/btcsuite/btcd.git synced 2026-08-13 12:32:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

psbt: limit value size in ReadTaprootBip32Derivation to prevent OOM

Browse source 
Cap the `value` slice to `MaxPsbtValueLength` to prevent potential
out-of-memory conditions during parsing. This ensures that total
allocation remains bounded and consistent with other PSBT fields.
This commit is contained in:
ffranr 2025-05-23 14:36:06 +01:00
parent 16c2b92afd
commit 565a7a8822
No known key found for this signature in database
GPG key ID: C4A995ED1B728904
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
btcutil/psbt/taproot.go
View file

@ -143,6 +143,13 @@ func minTaprootBip32DerivationByteSize(numHashes uint64) (uint64, error) {
func ReadTaprootBip32Derivation(xOnlyPubKey,
value []byte) (*TaprootBip32Derivation, error) {
// This function allocates additional memory while parsing the serialized
// data. To prevent potential out-of-memory (OOM) issues, we must validate
// the length of the value slice before proceeding.
if len(value) > MaxPsbtValueLength {
return nil, ErrInvalidPsbtFormat
}
// The taproot key BIP 32 derivation path is defined as:
// <hashes len> <leaf hash>* <4 byte fingerprint> <32-bit uint>*
// So we get at least 5 bytes for the length and the 4 byte fingerprint.