Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

'apply_changeset' the derivation index aren't sanitized #1688

Open
notmandatory opened this issue Nov 13, 2024 · 2 comments · May be fixed by #1792
Open

'apply_changeset' the derivation index aren't sanitized #1688

notmandatory opened this issue Nov 13, 2024 · 2 comments · May be fixed by #1792
Assignees
@f3r10
Labels
audit Suggested as result of external code audit module-blockchain

Comments

@notmandatory
Copy link
Member

notmandatory commented Nov 13, 2024 •
edited
Loading

"In apply_changeset the derivation index aren't sanitized. It could include a hardened index, which would break an invariant and trigger an internal crash."
@notmandatory notmandatory added this to BDK Nov 13, 2024
@notmandatory notmandatory converted this from a draft issue Nov 13, 2024
@notmandatory notmandatory added audit Suggested as result of external code audit module-blockchain labels Nov 13, 2024
@notmandatory notmandatory added this to the 1.0.0-beta milestone Nov 13, 2024
@notmandatory notmandatory moved this to Todo in BDK Nov 13, 2024
@notmandatory notmandatory removed this from the 1.0.0-beta milestone Nov 22, 2024
@f3r10
Copy link
Contributor

f3r10 commented Dec 16, 2024

Hello @notmandatory this issue refers to the method apply_changeset defined on https://github.com/bitcoindevkit/bdk/blob/master/crates/chain/src/indexer/keychain_txout.rs#L770 ?

@f3r10
Copy link
Contributor

f3r10 commented Jan 5, 2025

I'll give this one a try. 🤔

@f3r10 f3r10 linked a pull request Jan 7, 2025 that will close this issue
Open
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@f3r10 f3r10

Labels
audit Suggested as result of external code audit module-blockchain
Projects
BDK
Status: Todo
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(chain): sanitize derivation index before apply changeset f3r10/bdk
2 participants
@f3r10 @notmandatory