aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorfanquake <fanquake@gmail.com>2022-07-19 20:52:52 +0100
committerfanquake <fanquake@gmail.com>2022-07-19 20:54:59 +0100
commit6900162aeaf8cde98815df790971b4521000f82a (patch)
tree1954054a62a09321dc1b728e95f4ba9b981069f8 /src
parent9c97ba5451159312838d4ed2ff252cdf6a676250 (diff)
parent76fb300b63c5c0d01d768510ec69d894820432fa (diff)
downloadbitcoin-6900162aeaf8cde98815df790971b4521000f82a.tar.xz
Merge bitcoin/bitcoin#25513: psbt: Check Taproot tree depth and leaf versions
76fb300b63c5c0d01d768510ec69d894820432fa psbt: Check Taproot tree depth and leaf versions (Andrew Chow) Pull request description: Since TaprootBuilder has assertions for the depth and leaf versions, the PSBT decoder should check these values before calling TaprootBuilder::Add so that the assertions are not triggered on malformed taproot trees. Fixes https://github.com/bitcoin/bitcoin/pull/22558#issuecomment-1170935136 ACKs for top commit: Sjors: utACK 76fb300b63c5c0d01d768510ec69d894820432fa sipa: utACK 76fb300b63c5c0d01d768510ec69d894820432fa w0xlt: ACK https://github.com/bitcoin/bitcoin/pull/25513/commits/76fb300b63c5c0d01d768510ec69d894820432fa Tree-SHA512: 94b288bc1453d10bce9a8a6389bc866f2c71c76579b7908e22d6b5770ac387086f6221af8597668e62977d4d6861fe2d72ec7b052002a2c36769d056b2e66360
Diffstat (limited to 'src')
-rw-r--r--src/psbt.h6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/psbt.h b/src/psbt.h
index a143a99988..c390bb67d3 100644
--- a/src/psbt.h
+++ b/src/psbt.h
@@ -866,6 +866,12 @@ struct PSBTOutput
s_tree >> depth;
s_tree >> leaf_ver;
s_tree >> script;
+ if (depth > TAPROOT_CONTROL_MAX_NODE_COUNT) {
+ throw std::ios_base::failure("Output Taproot tree has as leaf greater than Taproot maximum depth");
+ }
+ if ((leaf_ver & ~TAPROOT_LEAF_MASK) != 0) {
+ throw std::ios_base::failure("Output Taproot tree has a leaf with an invalid leaf version");
+ }
m_tap_tree->Add((int)depth, script, (int)leaf_ver, true /* track */);
}
if (!m_tap_tree->IsComplete()) {