Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Assertion failure in ComputeType when processing script OP_0 OP_0 OP_EQUAL #13

Closed
practicalswift opened this issue Sep 12, 2019 · 0 comments · Fixed by #57
Closed

Assertion failure in ComputeType when processing script OP_0 OP_0 OP_EQUAL #13

practicalswift opened this issue Sep 12, 2019 · 0 comments · Fixed by #57

Comments

@practicalswift
Copy link
Contributor

practicalswift commented Sep 12, 2019 •
edited

The following assertion failure in ComputeType is hit when passing the script OP_0 OP_0 OP_EQUAL (00 00 87) to miniscript::FromScript.

bitcoin/script/miniscript.cpp:54: 
    miniscript::Type miniscript::internal::ComputeType(…):
    Assertion `k > 1 && k < n_subs' failed.
@practicalswift practicalswift mentioned this issue Sep 12, 2019
Closed
@practicalswift practicalswift mentioned this issue Sep 8, 2020
Closed
sanket1729 added a commit to sanket1729/miniscript that referenced this issue Jul 21, 2021
@practicalswift @sanket1729
Avoid heap out-of-bounds read in Node::CalcOps (test case: OP_0 OP_2 …
abe7d61 
…OP_EQUAL) and assertion failure in ComputeType (test case: OP_0 OP_0 OP_EQUAL)

Closes sipa#12.

Closes sipa#13.

Co-authored-by: sanket1729 <sanket1729@gmail.com>
@sanket1729 sanket1729 mentioned this issue Jul 21, 2021
Merged
darosior pushed a commit to darosior/miniscript that referenced this issue Aug 1, 2021
@practicalswift @sanket1729 @darosior
Avoid heap out-of-bounds read in Node::CalcOps (test case: OP_0 OP_2 …
ebb23c3 
…OP_EQUAL) and assertion failure in ComputeType (test case: OP_0 OP_0 OP_EQUAL)

Closes sipa#12.

Closes sipa#13.

Co-authored-by: sanket1729 <sanket1729@gmail.com>
darosior added a commit to darosior/miniscript that referenced this issue Aug 1, 2021
@darosior
test: make sure we now refuse to parse some malicious scripts
e74c7b8 
As reported in sipa#12 and
sipa#13 these two scripts
previously caused an out of bounds read and an assertion failure later
on. Make sure they now don't get parsed at all anymore.

Signed-off-by: Antoine Poinsot <darosior@protonmail.com>
darosior added a commit to darosior/miniscript that referenced this issue Aug 1, 2021
@darosior
test: make sure we now refuse to parse some malicious scripts
24a9e0b 
As reported in sipa#12 and
sipa#13 these two scripts
previously caused an out of bounds read and an assertion failure later
on. Make sure they now don't get parsed at all anymore.

Signed-off-by: Antoine Poinsot <darosior@protonmail.com>
@sipa sipa closed this as completed in 0d43166 Aug 19, 2021
@sipa sipa closed this as completed in #57 Aug 19, 2021
sipa added a commit that referenced this issue Aug 19, 2021
@sipa
Merge #57: Avoid heap out-of-bounds read in Node::CalcOps (test case:…
30a44f8 
… OP_0 OP_2 OP_EQUAL) and assertion failure in ComputeType (test case: OP_0 OP_0 OP_EQUAL)

a47dcc6 Add assertions: Raise assertion failure instead of doing an out-of-bounds read in case of k > sats.size() (sanket1729)
0d43166 Avoid heap out-of-bounds read in Node::CalcOps (test case: OP_0 OP_2 OP_EQUAL) and assertion failure in ComputeType (test case: OP_0 OP_0 OP_EQUAL) (practicalswift)

Pull request description:

  Closes #12.

  Closes #13.

  Supercedes #18

ACKs for top commit:
  sipa:
    utACK a47dcc6
  darosior:
    ACK a47dcc6
  meshcollider:
    utACK a47dcc6

Tree-SHA512: 85ea2f791e5b6a2c80dee567895dffe386f5fe4973b97dd7102b91f2e500bf9087dcbaeafe9e635abc02b27a97918bc69ae38b6769d93f2b3a071eb976a606c8
meshcollider pushed a commit to meshcollider/miniscript that referenced this issue Aug 20, 2021
@practicalswift @sanket1729 @meshcollider
Avoid heap out-of-bounds read in Node::CalcOps (test case: OP_0 OP_2 …
9a2c4b6 
…OP_EQUAL) and assertion failure in ComputeType (test case: OP_0 OP_0 OP_EQUAL)

Closes sipa#12.

Closes sipa#13.

Co-authored-by: sanket1729 <sanket1729@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@practicalswift