GlcoinCore/mempool
1
0
Fork 0
mirror of https://github.com/mempool/mempool.git synced 2026-08-13 12:33:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix scriptsig asm parsing buffer overflow

Browse source
This commit is contained in:
Mononaut 2025-12-10 09:13:35 +00:00
parent 76a8d82ff7
commit fcbdf7e71d
No known key found for this signature in database
GPG key ID: A3F058E41374C04E
1 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
backend/src/api/transaction-utils.ts
View file

@ -300,15 +300,15 @@ class TransactionUtils {
if (op >= 0x01 && op <= 0x4e) {
i++;
let push: number;
if (op === 0x4c) {
if (op === 0x4c && buf.length > i) {
push = buf.readUInt8(i);
b.push('OP_PUSHDATA1');
i += 1;
} else if (op === 0x4d) {
} else if (op === 0x4d && buf.length > i + 1) {
push = buf.readUInt16LE(i);
b.push('OP_PUSHDATA2');
i += 2;
} else if (op === 0x4e) {
} else if (op === 0x4e && buf.length > i + 3) {
push = buf.readUInt32LE(i);
b.push('OP_PUSHDATA4');
i += 4;
@ -317,13 +317,15 @@ class TransactionUtils {
b.push('OP_PUSHBYTES_' + push);
}
const data = buf.slice(i, i + push);
if (i >= buf.length) {
break;
}
const data = buf.subarray(i, Math.min(i + push, buf.length));
b.push(data.toString('hex'));
i += data.length;
if (data.length !== push) {
break;
}
b.push(data.toString('hex'));
i += data.length;
} else {
if (op === 0x00) {
b.push('OP_0');