phantom/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-04-29 14:59:39 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

wallet: fix segfault by avoiding invalid default-ctored external_spk_managers entry

Browse source 
In the method `CWallet::LoadActiveScriptPubKeyMan`, the map
`external_spk_managers` (or `internal_spk_managers`, if parameter
`internal` is false) is accessed via std::map::operator[], which means
that a default-ctored entry is created with a null-pointer as value, if
the key doesn't exist.  As soon as this value is dereferenced, a
segmentation fault occurs, e.g. in `CWallet::KeypoolCountExternalKeys`.

The bevaviour can be reproduced by the following steps (starting with empty regtest datadir):

$ ./src/bitcoind -regtest -daemon
$ ./src/bitcoin-cli -regtest -named createwallet_name=wallet descriptors=true blank=true
$ cat regtest-descriptors.txt
[
  {
    "desc": "tr([e4445899/49'/1'/0']tprv8ZgxMBicQKsPd8jCeBWsYLEoWxbVgzJDatJ7XkwQ6G3uF4FsHuaziHQ5JZAW4K515nj6kVVwPaNWZSMEcR7aFCwL4tQqTcaoprMKTTtm6Zg/1/*)#mr3llm7f",
    "timestamp": 1634652324,
    "active": true,
    "internal": true,
    "range": [
      0,
      999
    ],
    "next": 0
  }
]
$ ./src/bitcoin-cli -regtest importdescriptors "$(cat regtest-descriptors.txt)"
[
  {
    "success": true
  }
]
$ ./src/bitcoin-cli -regtest getwalletinfo
error: timeout on transient error: Could not connect to the server 127.0.0.1:18443 (error code 1 - "EOF reached")

Bug reported by Josef Vondrlik (josef-v).

Github-Pull: #23333
Rebased-From: 6911ab95f1
This commit is contained in:
Sebastian Falbesoner 2021-10-21 16:03:03 +02:00 • committed by fanquake
parent 282863a7e9
commit 227ae65254
No known key found for this signature in database
GPG key ID: 2EEB9F5CC09526C1
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/wallet/wallet.cpp
View file

@ -3187,7 +3187,8 @@ void CWallet::LoadActiveScriptPubKeyMan(uint256 id, OutputType type, bool intern
auto spk_man = m_spk_managers.at(id).get(); auto spk_man = m_spk_managers.at(id).get();
spk_mans[type] = spk_man; spk_mans[type] = spk_man;
if (spk_mans_other[type] == spk_man) { const auto it = spk_mans_other.find(type);
if (it != spk_mans_other.end() && it->second == spk_man) {
spk_mans_other.erase(type); spk_mans_other.erase(type);
} }