From addf9d6502db12cebcc5976df3111cac1a369b82 Mon Sep 17 00:00:00 2001 From: muxator Date: Thu, 6 Oct 2022 22:17:49 +0200 Subject: [PATCH] rpc: fix crash in deriveaddresses when derivation index is 2147483647 2147483647 is the maximum positive value of a signed int32, and - currently - the maximum value that the deriveaddresses bitcoin RPC call accepts as derivation index due to its input validation routines. Before this change, when the derivation index (and thus range_end) reached std::numeric_limits::max(), the "i" variable in the for cycle (which is declared as int, and as such 32 bits in size on most platforms) would be incremented at the end of the first iteration and then warp back to -2147483648. This caused SIGABRT in bitcoind and a core dump. This change assigns "i" an explicit size of 64 bits on every platform, sidestepping the problem. Fixes #26274. --- src/rpc/output_script.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rpc/output_script.cpp b/src/rpc/output_script.cpp index 744f8098147..a980c609e80 100644 --- a/src/rpc/output_script.cpp +++ b/src/rpc/output_script.cpp @@ -273,7 +273,7 @@ static RPCHelpMan deriveaddresses() UniValue addresses(UniValue::VARR); - for (int i = range_begin; i <= range_end; ++i) { + for (int64_t i = range_begin; i <= range_end; ++i) { FlatSigningProvider provider; std::vector scripts; if (!desc->Expand(i, key_provider, scripts, provider)) {