search

brunoerg / bitcoinfuzz

Differential Fuzzing of Bitcoin implementations and libraries
31 stars 11 forks source link

BlockTransactionRequest: Non-conformity of BIP-152 in rust bitcoin #57

Open hax0kartik opened 2 months ago

hax0kartik commented 2 months ago

I got a crash in BlockTransactionRequest deserialization target as rust-bitcoin does not conform to BIP-152 and treats indexes as uint64_t values when according to BIP and Core, they should be treated as uint16_t values.

This also makes it possible to theoretically create a non-conformant BlockTransactions/BlockTxn message with more than U16_MAX transactions in a Block. ("Theoretically" because I am not sure whether a node would have a Block with such a large number of transactions anyway)

I think at the bare minimum, rust-bitcoin should return an error with an index greater than u16 max while deserializing a BlockTransactionRequest.

apoelstra commented 2 months ago

cc https://github.com/rust-bitcoin/rust-bitcoin/pull/2970

hax0kartik commented 2 months ago

cc rust-bitcoin/rust-bitcoin#2970

Hi, please correct me if I am wrong but I think that's an unrelated issue in HeaderandShortIds while this is a issue with BlockTransactionRequest

apoelstra commented 2 months ago

Oh! You're right, sorry. I saw "BIP-152" and thought it was a dupe.