Wipe the secp256k1 scalar used for the [1, N-1] range validation as
soon as DecodeWIF returns, so the decoded private key value does not
linger in this local after use. Addresses review feedback on #2545.
DecodeWIF did not validate that the decoded private key falls within the
valid range [1, N-1] for a secp256k1 private key. The raw 32-byte key
material was passed straight to btcec.PrivKeyFromBytes, which reduces the
scalar modulo the group order N and clamps to zero, returning no error.
As a result, a WIF encoding a private key of zero, the group order N, or
any value >= N was silently accepted. For keys >= N this is particularly
dangerous: DecodeWIF returned a private key that differs from the one
actually encoded in the WIF (e.g. a WIF for N+5 decoded to the key 5),
so an application importing such a WIF would obtain a valid-looking but
wrong key pair, with no indication that anything was off. This is also
inconsistent with hdkeychain.NewKeyFromString in the same package, which
already rejects private keys outside [1, N-1].
Validate the range using a ModNScalar (constant time): SetByteSlice
reports an overflow when the value is >= N, and IsZero covers the zero
key. Out-of-range keys now return ErrMalformedPrivateKey.
Add regression test cases (zero, N, and N+5) to TestEncodeDecodeWIF.
Signed-off-by: Lrifton92 <Lrifton92@users.noreply.github.com>
In this commit, we strip all of the local `replace ... => ../...`
directives that were introduced as part of #1825 (the v2 module
restructuring), now that proper tags exist for every freshly carved-out
submodule. Every in-tree go.mod is pinned to the newly published tags:
chainhash/v2.0.0, wire/v2.0.0, chaincfg/v2.0.0, address/v2.0.0,
txscript/v2.0.0, btcutil/v2.0.0, psbt/v2.0.0, and btcec is bumped to
v2.5.0 since it now depends on chainhash/v2 (previously
chaincfg/chainhash).
While here, we also unify the Go toolchain to 1.25 across every
submodule so the workspace resolves a consistent set of language
features.
Finally, we bump the main btcd version to v0.26.0-beta.rc1 in
preparation for the upcoming release candidate.
In this commit, we update every in-tree go.mod to declare go 1.25 and
have CI build with 1.26.3 (Dockerfile uses the golang:1.26-alpine base).
Docs that mention the minimum required Go version are aligned with the
new floor as well.
Fixes#2527, which flagged the README.md / go.mod version mismatch (the
README claimed 1.22 while the root + v2transport go.mod files already
required 1.23.2).
In this commit, we pin every in-tree go.mod to the freshly cut submodule
tags ahead of a btcd point release: btcec/v2.4.0, btcutil/v1.2.0,
btcutil/psbt/v1.2.0, and chaincfg/chainhash/v1.2.0. The btcec bump also
drags secp256k1 up to v4.4.0 (and blake256 to v1.1.0 transitively) for
every module that imports btcec.
v2transport stays at v1.0.1 since no v2transport code changed since the
last tag, but its go.mod is bumped here so the workspace resolves to a
consistent set of internal deps.
The previous commit exported the interfaceAddrs helper in net.go but
missed the parallel definition in net_noop.go (build tag: appengine),
which left builds with -tags appengine broken with:
./certgen.go:79:16: undefined: InterfaceAddrs
Rename the appengine no-op variant to match, restoring the appengine
build.
Golang's net package has been broken for android since android 11
and the node will not be able to call net.InterfaceAddr() without
root.
For android builds, we use anet so that the btcd node can be used
without root.
In this commit, we ensure hash function parameters are consistent with
filter size to avoid unnecessary operations. A filter with no capacity
doesn't actually require any hash functions, so we can cut that loop
short.
Cap the `value` slice to `MaxPsbtValueLength` to prevent potential
out-of-memory conditions during parsing. This ensures that total
allocation remains bounded and consistent with other PSBT fields.
Protect against overflows when parsing malformed Taproot BIP32
derivation fields. This ensures that deserialization fails safely if the
declared number of leaf hashes would otherwise cause an integer
overflow.
Fixes#2199.
Previous to this fix the keytype was only interpreted as a single byte,
even though BIP-0174 states it is to be parsed as a CompactSize/VarInt.
This exposes publicly the ability to decode arbitrary-length bech32
strings and return the bech32 version that was used in the encoding. It
provides the underlying functionality for both DecodeNoLimit and
DecodeGeneric.
btcutil.Block caches the serialized raw bytes of the block during ibd.
This serialized block bytes includes the serialized tx. The current tx
hash generation will re-serialized the de-serialized tx to create the
raw bytes and it'll only then hash that.
This commit changes the code so that the re-serialization never happens,
saving tons of cpu and memory overhead.
BuildMerkleTreeStore used to return a pointer, but it is changed to
return a chainhash.Hash directly. This allows the compiler to make
optimizations in some cases and avoids a memory allocation.
