ð
Original date posted:2011-12-25
ðïž Summary of this message: A remote vulnerability was reported in the master bitcoin/bitcoin tree, affecting those who compiled their own bitcoind/bitcoin-qt in the last 5 days.
ð Original message:Reposted from the forums:
makomk reported a remote vulnerability that I pulled into the master
bitcoin/bitcoin tree on December 20. If you are running git-HEAD code
on the production network you should pull the latest code to get the
bug fixed.
This affects only anybody who has pulled and compiled their own
bitcoind/bitcoin-qt from the source tree in the last 5 days.
Gory details:
I made a mistake. I refactored the ConnectInputs() function into two
pieces (FetchInputs() and ConnectInputs()), and should have duplicated
a check in ConnectInputs for an out-of-range
previous-transaction-output in the FetchInputs() method. The result
was a new method I wrote to help prevent a possible OP_EVAL-related
denial-of-service attack (AreInputsStandard()) could crash with an
out-of-bounds memory access if given an invalid transaction.
The bug-fix puts a check in FetchInputs and an assertion in
AreInputsStandard. This does not affect the back-ported "mining only"
code I wrote that some miners and pools have started using.
The good news is this was found and reported before binaries with the
vulnerability were released; the bad news is this was not found before
the code was pulled and could have made it into the next release if
makomk had not been testing some unrelated code.
Before releasing 0.6, I would like to have an "intelligent,
bitcoin-specific fuzzing tool" that automatically finds this type of
bug that we can run before every release. If anybody already has one,
please speak up!
--
--
Gavin Andresen
Gavin Andresen [ARCHIVE] /
npub1s4âŠd44kw
2023-06-07 02:52:49
in reply to nevent1qâŠmvm8
Author Public Key
npub1s4lj77xuzcu7wy04afcr487f0r3za0f8n2775xrpkld2sv639mjqsd44kwPublished at
2023-06-07 02:52:49Event JSON
{
"id": "cfba1563ca77fa690e02f18011e7410d18d07fcd2458e6a70f8ffbe361255db2",
"pubkey": "857f2f78dc1639e711f5ea703a9fc978e22ebd279abdea1861b7daa833512ee4",
"created_at": 1686106369,
"kind": 1,
"tags": [
[
"e",
"bfa99da83c12cc97e0fb4075bf0fc2f5c53f55afb8158b0572f22d43e2ff897d",
"",
"reply"
],
[
"p",
"a23dbf6c6cc83e14cc3df4e56cc71845f611908084cfe620e83e40c06ccdd3d0"
]
],
"content": "ð
Original date posted:2011-12-25\nðïž Summary of this message: A remote vulnerability was reported in the master bitcoin/bitcoin tree, affecting those who compiled their own bitcoind/bitcoin-qt in the last 5 days.\nð Original message:Reposted from the forums:\n\nmakomk reported a remote vulnerability that I pulled into the master\nbitcoin/bitcoin tree on December 20. If you are running git-HEAD code\non the production network you should pull the latest code to get the\nbug fixed.\n\nThis affects only anybody who has pulled and compiled their own\nbitcoind/bitcoin-qt from the source tree in the last 5 days.\n\nGory details:\n\nI made a mistake. I refactored the ConnectInputs() function into two\npieces (FetchInputs() and ConnectInputs()), and should have duplicated\na check in ConnectInputs for an out-of-range\nprevious-transaction-output in the FetchInputs() method. The result\nwas a new method I wrote to help prevent a possible OP_EVAL-related\ndenial-of-service attack (AreInputsStandard()) could crash with an\nout-of-bounds memory access if given an invalid transaction.\n\nThe bug-fix puts a check in FetchInputs and an assertion in\nAreInputsStandard. This does not affect the back-ported \"mining only\"\ncode I wrote that some miners and pools have started using.\n\nThe good news is this was found and reported before binaries with the\nvulnerability were released; the bad news is this was not found before\nthe code was pulled and could have made it into the next release if\nmakomk had not been testing some unrelated code.\n\nBefore releasing 0.6, I would like to have an \"intelligent,\nbitcoin-specific fuzzing tool\" that automatically finds this type of\nbug that we can run before every release. If anybody already has one,\nplease speak up!\n\n-- \n--\nGavin Andresen",
"sig": "8f4e749e6a4412447876d3ccace3e9c48cdf582b2a60ece899902ec299aeb73273322f885085797dd85506b2eb7bb2433dd7b262e4ac50bef0e8e52ae02e1517"
}