diff options
author | MarcoFalke <falke.marco@gmail.com> | 2018-07-19 17:39:48 -0400 |
---|---|---|
committer | MarcoFalke <falke.marco@gmail.com> | 2018-07-19 17:39:59 -0400 |
commit | aba2e666d7fd42f40c0bf4196dbff66a48eaf97b (patch) | |
tree | 7ba47fc1579648626ff767d8893a7ad31979dc0e /src/wallet/rpcwallet.cpp | |
parent | f281f8f755229ed720a088c44ae14189ec4ff9c8 (diff) | |
parent | 27ee53c1aedae4f27458537c61804b6fef34ce3c (diff) | |
download | bitcoin-aba2e666d7fd42f40c0bf4196dbff66a48eaf97b.tar.xz |
Merge #13712: wallet: Fix non-determinism in ParseHDKeypath(...). Avoid using an uninitialized variable in path calculation.
27ee53c1ae wallet: Add error handling. Check return value of ParseUInt32(...) in ParseHDKeypath(...). (practicalswift)
7223263899 wallet: Add tests for ParseHDKeypath(...) (practicalswift)
Pull request description:
Add error handling. Check return value of `ParseUInt32(...)` in `ParseHDKeypath(...)`.
`ParseUInt32(...)` returns `false` if the entire string could not be parsed or when an overflow or underflow occurred. In such case the uninitialized variable `number` would be used in the calculation of `path` (prior to this commit).
An example key path triggering this is `m/0/4294967296`:
```
ParseHDKeypath("m/0/4294967296", keypath);
```
`4294967296` is `1` + `0xFFFFFFFF` (`uint32_t` max: `4294967295`).
Introduced in a4b06fb42eb0ad94e562ca839391b57e69285136 which was merged into `master` 14 hours ago as part of #13557 ("BIP 174 PSBT Serializations and RPCs").
Tree-SHA512: e5ff423f67c18d82c1231bde6343587a453e793c32004d93dc9b61be6d9372b57a6b2c9978d9eb1000d6cc82fd180f2486013f928dca737fb92daad22c16e467
Diffstat (limited to 'src/wallet/rpcwallet.cpp')
-rw-r--r-- | src/wallet/rpcwallet.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp index 78ea5eac92..02cdd0f9f1 100644 --- a/src/wallet/rpcwallet.cpp +++ b/src/wallet/rpcwallet.cpp @@ -4433,7 +4433,9 @@ bool ParseHDKeypath(std::string keypath_str, std::vector<uint32_t>& keypath) return false; } uint32_t number; - ParseUInt32(item, &number); + if (!ParseUInt32(item, &number)) { + return false; + } path |= number; keypath.push_back(path); |