From 6460917cab14f26494487246a3358899723ffdcd Mon Sep 17 00:00:00 2001
From: selsta <selsta@sent.at>
Date: Sat, 9 May 2026 23:33:38 +0200
Subject: [PATCH] serialization: avoid blob memcpy of secret_key vector

---
 .../keyvalue_serialization_overloads.h        |  7 +++++++
 src/cryptonote_basic/account.h                | 20 ++++++++++++++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/contrib/epee/include/serialization/keyvalue_serialization_overloads.h b/contrib/epee/include/serialization/keyvalue_serialization_overloads.h
index 8c5e28d7a..fc85e38bb 100644
--- a/contrib/epee/include/serialization/keyvalue_serialization_overloads.h
+++ b/contrib/epee/include/serialization/keyvalue_serialization_overloads.h
@@ -32,6 +32,7 @@
 #include <list>
 #include <vector>
 #include <deque>
+#include <type_traits>
 #include <boost/mpl/vector.hpp>
 #include <boost/mpl/contains_fwd.hpp>
 
@@ -114,6 +115,9 @@ namespace epee
     template<class stl_container, class t_storage>
     static bool serialize_stl_container_pod_val_as_blob(const stl_container& container, t_storage& stg, typename t_storage::hsection hparent_section, const char* pname)
     {
+      static_assert(std::is_trivially_copyable_v<typename stl_container::value_type>,
+        "serialize_stl_container_pod_val_as_blob requires trivially copyable value_type");
+
       if(!container.size()) return true;
       std::string mb;
       mb.resize(sizeof(typename stl_container::value_type)*container.size());
@@ -129,6 +133,9 @@ namespace epee
     template<class stl_container, class t_storage>
     static bool unserialize_stl_container_pod_val_as_blob(stl_container& container, t_storage& stg, typename t_storage::hsection hparent_section, const char* pname)
     {
+      static_assert(std::is_trivially_copyable_v<typename stl_container::value_type>,
+        "unserialize_stl_container_pod_val_as_blob requires trivially copyable value_type");
+
       container.clear();
       std::string buff;
       bool res = stg.get_value(pname, buff, hparent_section);
diff --git a/src/cryptonote_basic/account.h b/src/cryptonote_basic/account.h
index de5912032..71b5b64a1 100644
--- a/src/cryptonote_basic/account.h
+++ b/src/cryptonote_basic/account.h
@@ -50,7 +50,25 @@ namespace cryptonote
       KV_SERIALIZE(m_account_address)
       KV_SERIALIZE_VAL_POD_AS_BLOB_FORCE(m_spend_secret_key)
       KV_SERIALIZE_VAL_POD_AS_BLOB_FORCE(m_view_secret_key)
-      KV_SERIALIZE_CONTAINER_POD_AS_BLOB(m_multisig_keys)
+      if constexpr (is_store)
+      {
+        std::vector<crypto::ec_scalar> multisig_keys;
+        multisig_keys.reserve(this_ref.m_multisig_keys.size());
+        for (const crypto::secret_key& key : this_ref.m_multisig_keys)
+          multisig_keys.push_back(unwrap(unwrap(key)));
+        epee::serialization::selector<is_store>::serialize_stl_container_pod_val_as_blob(
+          multisig_keys, stg, hparent_section, "m_multisig_keys");
+      }
+      else
+      {
+        std::vector<crypto::ec_scalar> multisig_keys;
+        epee::serialization::selector<is_store>::serialize_stl_container_pod_val_as_blob(
+          multisig_keys, stg, hparent_section, "m_multisig_keys");
+        this_ref.m_multisig_keys.clear();
+        this_ref.m_multisig_keys.reserve(multisig_keys.size());
+        for (const crypto::ec_scalar& key : multisig_keys)
+          this_ref.m_multisig_keys.emplace_back(tools::scrubbed<crypto::ec_scalar>{key});
+      }
       const crypto::chacha_iv default_iv{{0, 0, 0, 0, 0, 0, 0, 0}};
       KV_SERIALIZE_VAL_POD_AS_BLOB_OPT(m_encryption_iv, default_iv)
     END_KV_SERIALIZE_MAP()