0bff9b06f7
There is a crashing bug in psbt.h which works as follows. This occurs in
the psbt_deserialize_input fuzz test, which deserializes an input and
then tries to reserialize it. Here a PSET input may contain a mainchain
transaction, which is where our trouble is.
The process is as follows:
1. On line 901, we create a CTransactionRef, which is a newtype around
std::shared_ptr<CTransaction> which defaults to being null.
2. On line 903 we then call `UnserializeFromVector` to populate this,
where this is a helper function which attempts to read some number of
objects from a byte vector, i.e. a length-prefixed blob.
3. HOWEVER, `UnserializeFromVector` when given an empty vector, decides
that it has successfully deserialized zero elements, and returns.
4. Then, on line 904 we assign the CTransactionRef, which is a valid
std::shared_ptr whose internal pointer is NULL, to `m_peg_in_tx`,
which is a variant of monostate, Bitcoin::CTransactionRef, and
CTransactionRef. Its variant changes from the default monostate
to CTransactionRef.
5. Then, on line 419, we call `std::get_if<CTransactionRef>` on this
object, which returns a std::optional<CTransactionRef>. Because
`m_peg_in_tx` is in the `CTransactionRef` variant, this succeeds,
returning a true std::optional containing a valid std::shared_ptr
which contains a NULL pointer.
6. Then, on line 420, we call `if (peg_in_tx)`, which is true, because
we have a true std::optional. We then dereference it on line 423,
which is perfectly legal, to get our std::shared_ptr, and pass this
shared pointer to SerializeToVector.
7. SerializeToVector passes through like 6 layers of serialize.h
obfuscation and eventually dereferences the shared pointer, but
because it's NULL, this is a NULL pointer dereference, and we get a
crash.
There are two lessons here:
1. Don't use C++. As I say in
|
||
|---|---|---|
| .github | ||
| .tx | ||
| build-aux/m4 | ||
| build_msvc | ||
| ci | ||
| contrib | ||
| depends | ||
| doc | ||
| share | ||
| src | ||
| test | ||
| .cirrus.yml | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .python-version | ||
| .style.yapf | ||
| autogen.sh | ||
| configure.ac | ||
| CONTRIBUTING.md | ||
| COPYING | ||
| INSTALL.md | ||
| libbitcoinconsensus.pc.in | ||
| Makefile.am | ||
| README.md | ||
| REVIEWERS | ||
| SECURITY.md | ||
Elements Project blockchain platform
This is the integration and staging tree for the Elements blockchain platform, a collection of feature experiments and extensions to the Bitcoin protocol. This platform enables anyone to build their own businesses or networks pegged to Bitcoin as a sidechain or run as a standalone blockchain with arbitrary asset tokens.
Modes
Elements supports a few different pre-set chains for syncing. Note though some are intended for QA and debugging only:
- Liquid mode:
elementsd -chain=liquidv1(syncs with Liquid network) - Bitcoin mainnet mode:
elementsd -chain=main(not intended to be run for commerce) - Bitcoin testnet mode:
elementsd -chain=testnet3 - Bitcoin regtest mode:
elementsd -chain=regtest - Elements custom chains: Any other
-chain=argument. It has regtest-like default parameters that can be over-ridden by the user by a rich set of start-up options.
Confidential Assets
The latest feature in the Elements blockchain platform is Confidential Assets, the ability to issue multiple assets on a blockchain where asset identifiers and amounts are blinded yet auditable through the use of applied cryptography.
- Announcement of Confidential Assets
- Confidential Assets Whitepaper to be presented April 7th at Financial Cryptography 2017 in Malta
- Confidential Assets Tutorial
- Confidential Assets Demo
- Elements Code Tutorial covering blockchain configuration and how to use the main features.
Features of the Elements blockchain platform
Compared to Bitcoin itself, it adds the following features:
- Confidential Assets
- Confidential Transactions
- Federated Two-Way Peg
- Signed Blocks
- Additional opcodes
Previous elements that have been integrated into Bitcoin:
- Segregated Witness
- Relative Lock Time
Elements deferred for additional research and standardization:
Additional RPC commands and parameters:
The CI (Continuous Integration) systems make sure that every pull request is built for Windows, Linux, and macOS, and that unit/sanity tests are run automatically.
License
Elements is released under the terms of the MIT license. See COPYING for more information or see http://opensource.org/licenses/MIT.
What is the Elements Project?
Elements is an open source, sidechain-capable blockchain platform. It also allows experiments to more rapidly bring technical innovation to the Bitcoin ecosystem.
Learn more on the Elements Project website
https://github.com/ElementsProject/elementsproject.github.io