Skip to content

Conversation

brunoerg
Copy link

A PSBT should be considered invalid if the size of <valuedata> doesn't match the specified size in <valuesize>. However we don't have any test case for it (and might be not well specified?). During differential fuzzing I noticed this is currently verified in Bitcoin Core (see below) but not checked in other implementations (e.g. btcd), causing a mismatch between them.

// Takes a stream and multiple arguments and unserializes them first as a vector then each object individually in the order provided in the arguments
template<typename Stream, typename... X>
void UnserializeFromVector(Stream& s, X&&... args)
{
    size_t expected_size = ReadCompactSize(s);
    size_t remaining_before = s.size();
    UnserializeMany(s, args...);
    size_t remaining_after = s.size();
    if (remaining_after + expected_size != remaining_before) {
        throw std::ios_base::failure("Size of value was not the stated size");
    }
}

@murchandamus murchandamus added Proposed BIP modification Pending acceptance This BIP modification requires sign-off by the champion of the BIP being modified Bug fix labels Sep 18, 2025
@murchandamus
Copy link
Contributor

cc: @achow101

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Bug fix Pending acceptance This BIP modification requires sign-off by the champion of the BIP being modified Proposed BIP modification

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants