gitea-mirror/monero
1
0
Fork 0
mirror of https://github.com/monero-project/monero.git synced 2026-07-28 22:51:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

wallet2: avoid std::out_of_range on a truncated tx set blob

Browse Source 
parse_unsigned_tx_from_str() and parse_tx_from_str() strip the magic,
then read the version byte and call s.substr(1) without checking a
version byte follows. A blob equal to just the magic leaves an empty
remainder, so s.substr(1) throws std::out_of_range instead of the
function returning false. Require magic + a version byte first.
This commit is contained in:
Thomas
2026-06-20 21:13:30 +02:00
parent 6476ec8f2c
commit 36bb2d0e7d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wallet/wallet2.cpp
+2 -2
View File
@@ -7743,7 +7743,7 @@ bool wallet2::parse_unsigned_tx_from_str(const std::string &unsigned_tx_st, unsi
{
std::string s = unsigned_tx_st;
const size_t magiclen = strlen(UNSIGNED_TX_PREFIX) - 1;
if (strncmp(s.c_str(), UNSIGNED_TX_PREFIX, magiclen))
if (s.size() < magiclen + 1 || strncmp(s.c_str(), UNSIGNED_TX_PREFIX, magiclen))
{
LOG_PRINT_L0("Bad magic from unsigned tx");
return false;
@@ -8021,7 +8021,7 @@ bool wallet2::parse_tx_from_str(const std::string &signed_tx_st, std::vector<too
signed_tx_set signed_txs;
const size_t magiclen = strlen(SIGNED_TX_PREFIX) - 1;
if (strncmp(s.c_str(), SIGNED_TX_PREFIX, magiclen))
if (s.size() < magiclen + 1 || strncmp(s.c_str(), SIGNED_TX_PREFIX, magiclen))
{
LOG_PRINT_L0("Bad magic from signed transaction");
return false;