phantom/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-01-25 10:43:19 -03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

extended keys: fail to derive too large depth instead of wrapping around

Browse source 
This issue was reported to me by Marco Falke, and found with the
descriptor_parse fuzz target.
This commit is contained in:
Antoine Poinsot 2022-07-19 11:58:16 +02:00
parent 8dc6670ce1
commit fb9faffae3
No known key found for this signature in database
GPG key ID: E13FC145CD3F4304
3 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/key.cpp
View file

@ -333,6 +333,7 @@ bool CKey::Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const
}
bool CExtKey::Derive(CExtKey &out, unsigned int _nChild) const {
if (nDepth == std::numeric_limits<unsigned char>::max()) return false;
out.nDepth = nDepth + 1;
CKeyID id = key.GetPubKey().GetID();
memcpy(out.vchFingerprint, &id, 4);

1
src/pubkey.cpp
View file

@ -365,6 +365,7 @@ void CExtPubKey::DecodeWithVersion(const unsigned char code[BIP32_EXTKEY_WITH_VE
}
bool CExtPubKey::Derive(CExtPubKey &out, unsigned int _nChild) const {
if (nDepth == std::numeric_limits<unsigned char>::max()) return false;
out.nDepth = nDepth + 1;
CKeyID id = pubkey.GetID();
memcpy(out.vchFingerprint, &id, 4);

18
src/test/bip32_tests.cpp
View file

@ -184,4 +184,22 @@ BOOST_AUTO_TEST_CASE(bip32_test5) {
}
}
BOOST_AUTO_TEST_CASE(bip32_max_depth) {
CExtKey key_parent{DecodeExtKey(test1.vDerive[0].prv)}, key_child;
CExtPubKey pubkey_parent{DecodeExtPubKey(test1.vDerive[0].pub)}, pubkey_child;
// We can derive up to the 255th depth..
for (auto i = 0; i++ < 255;) {
BOOST_CHECK(key_parent.Derive(key_child, 0));
std::swap(key_parent, key_child);
BOOST_CHECK(pubkey_parent.Derive(pubkey_child, 0));
std::swap(pubkey_parent, pubkey_child);
}
// But trying to derive a non-existent 256th depth will fail!
BOOST_CHECK(key_parent.nDepth == 255 && pubkey_parent.nDepth == 255);
BOOST_CHECK(!key_parent.Derive(key_child, 0));
BOOST_CHECK(!pubkey_parent.Derive(pubkey_child, 0));
}
BOOST_AUTO_TEST_SUITE_END()