From 565a7a8822450b671eab9b9fa311232ccd65ac19 Mon Sep 17 00:00:00 2001 From: ffranr Date: Fri, 23 May 2025 14:36:06 +0100 Subject: [PATCH] psbt: limit value size in ReadTaprootBip32Derivation to prevent OOM Cap the `value` slice to `MaxPsbtValueLength` to prevent potential out-of-memory conditions during parsing. This ensures that total allocation remains bounded and consistent with other PSBT fields. --- btcutil/psbt/taproot.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/btcutil/psbt/taproot.go b/btcutil/psbt/taproot.go index 26e435bf..02a0e3a2 100644 --- a/btcutil/psbt/taproot.go +++ b/btcutil/psbt/taproot.go @@ -143,6 +143,13 @@ func minTaprootBip32DerivationByteSize(numHashes uint64) (uint64, error) { func ReadTaprootBip32Derivation(xOnlyPubKey, value []byte) (*TaprootBip32Derivation, error) { + // This function allocates additional memory while parsing the serialized + // data. To prevent potential out-of-memory (OOM) issues, we must validate + // the length of the value slice before proceeding. + if len(value) > MaxPsbtValueLength { + return nil, ErrInvalidPsbtFormat + } + // The taproot key BIP 32 derivation path is defined as: // * <4 byte fingerprint> <32-bit uint>* // So we get at least 5 bytes for the length and the 4 byte fingerprint.