Deion A malicious node that is modified such that it does no

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clip

Fixed by <a class="issue-link js-issue-link" data-error-text="Failed to load title" da

Honest nodes segfault when a malicious node sends a PoS block without a coinstake tx. about qtum HOT 5 CLOSED

davidjaenson commented on July 17, 2024

Honest nodes segfault when a malicious node sends a PoS block without a coinstake tx.

from qtum.

Comments (5)

Earlz commented on July 17, 2024

Do you have a stacktrace from the honest node?

from qtum.

Earlz commented on July 17, 2024

@davidjaenson can you add an automated test for this case? Basically ensure that CheckBlock and AcceptBlock rejects a PoS block with no coinstake tx

from qtum.

davidjaenson commented on July 17, 2024

#0  0x00005555557dad94 in CTransaction::IsCoinStake (this=0x74) at ./primitives/transaction.h:397
#1  0x00005555557b6a77 in CheckBlock (block=..., state=..., consensusParams=..., 
    fCheckPOW=fCheckPOW@entry=true, fCheckMerkleRoot=fCheckMerkleRoot@entry=true, 
    fCheckSig=fCheckSig@entry=true) at validation.cpp:3546
#2  0x000055555582da48 in PartiallyDownloadedBlock::FillBlock (this=0x7fffac403710, block=..., 
    vtx_missing=std::vector of length 0, capacity 0) at blockencodings.cpp:202
#3  0x00005555556dda15 in ProcessMessage (pfrom=0x7fffac000020, pfrom@entry=0x7fffbb7fce40, 
    strCommand="blocktxn", vRecv=..., nTimeReceived=nTimeReceived@entry=93825004973920, chainparams=..., 
    connman=..., interruptMsgProc=...) at net_processing.cpp:2183
#4  0x00005555556de894 in ProcessMessage (pfrom=0x7fffbb7fce40, pfrom@entry=0x7fffbc0008c0, 
    strCommand="cmpctblock", vRecv=..., nTimeReceived=93825004973920, chainparams=..., connman=..., 
    interruptMsgProc=...) at net_processing.cpp:2136

The problem appears to be at
https://github.com/qtumproject/qtum_new/blob/ce3e47d30c9b26e1ee9b36a978664f0ba0a7107e/src/validation.cpp#L3546
which has the potential for being an out of range access

from qtum.

Earlz commented on July 17, 2024

I was able to repro it and fixed that specific area, look at my latest PR

from qtum.

Earlz commented on July 17, 2024

Fixed by #144

from qtum.

Recommend Projects