Bitcoin Core

dbwrapper: use `SpanReader` for iterator keys

`CDBIterator::GetKey()` only deserializes the current LevelDB key once.
`GetKeyImpl()` already exposes the current key as a contiguous borrowed byte span, and `GetKey()` creates a fresh local reader and only performs immediate forward reads before returning.

Switch this path to `SpanReader` so the key bytes are read in place instead of being copied into a temporary `DataStream`.
This keeps the same exception swallowing and `bool` return semantics while avoiding the extra allocation and copy.

The preceding test locks down the subtle safety property that matters here: a failed decode must not consume the current iterator entry.
Note that the same simplification does not apply to `GetValue()`, because that path deobfuscates the value bytes in place first and still needs an owning mutable buffer.

test: cover failed `CDBIterator::GetKey()` deserialization

The upcoming change will replace the temporary owning `DataStream` inside `CDBIterator::GetKey()` with a borrowed reader over the current LevelDB key bytes.
The copied `DataStream` currently insulates the iterator entry from a failed decode, so the optimization is only safe if a deserialization failure still returns `false` and leaves the same key/value readable afterward.

Extend `dbwrapper_iterator` to read a one-byte key as a `uint16_t`.
The read must fail, return `false`, and still allow the same key and value to be read afterward.
This would fail if `GetKey()` stopped swallowing deserialization exceptions, or if a failed decode started consuming shared iterator state instead of only temporary reader state.

Drop the dead `const_cast` in the test while here, since `dbw` is already non-const.

Locking down that contract first makes the following `SpanReader` switch a behavior-preserving optimization.

fuzz: apply node context reset pattern to p2p_handshake

Apply the node context reset pattern from fabf8d1 to p2p_handshake. Previous pattern created local AddrMan and Warnings objects, leaving connman holding dangling references across iterations. Reset and reinstall node.addrman and node.peerman each iteration so sanitizers can detect stale pointer usage.

fuzz: remove redundant CScript method calls from script harness

The script harness was calling GetSigOpCount, HasValidOps,
IsPayToAnchor, IsPayToScriptHash, IsPayToWitnessScriptHash, and
IsPushOnly on the fuzzed CScript. All of these are already covered
by the script_ops harness, which is the dedicated harness for
CScript member methods.

Also add the missing IsPayToAnchor call to script_ops so the move
preserves coverage.

wallet: remove fUpdate argument from AddToWalletIfInvolvingMe

Its only usage passes true.

wallet: remove update_tx argument from SyncTransaction

Its only usage passes true.

wallet: remove fUpdate argument from ScanForWalletTransactions

Only the unit test code passes false, the actual code passes
true always. I don't see a reason why the tests need to exercise
a behaviour that never happens in production.

wallet: remove update argument from RescanFromTime method

Its only usage passes true.

refactor: use _MiB consistently for Mebibyte conversions

Replace hard-coded MiB byte conversions (e.g. `1024*1024`, `1<<20`, `1048576`) with the existing `_MiB` literal to improve readability and avoid repeating constants.
In the few spots where arithmetic involves signed values, the result is identical to the previous code assuming those quantities never turn negative.

Also switch to brace init on every declaration assigned from `_MiB`/`_GiB` literals so a future oversized value (e.g. `unsigned int x{4096_MiB}`) becomes a compile error through the C++11 narrowing check instead of silently truncating.

Extend unit tests to cover the 32-bit `size_t` overflow boundary and to assert equivalence for integer and floating-point conversions.

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>
Co-authored-by: w0xlt <94266259+w0xlt@users.noreply.github.com>

util: add _GiB for Gibibyte conversions

Introduce `operator""_GiB`, sharing the overflow-checked conversion logic with the existing `operator""_MiB`.

Use `1_GiB` in a few existing places where it is a drop-in replacement (e.g. `1024_MiB`, `1<<30`) and extend unit tests to cover boundary behavior.

Change CChain::FindFork() to take ref

The internal null-guard in FindFork() was removed in favor of adding any missing guards at call sites.

Change pindexMostWork parameter of ActivateBestChainStep() to reference

ActivateBestChainStep() is always called with non-nullptr pindexMostWork parameter,
change the type of the parameter from pointer to reference to enforce this.
Also rename the parameter (prefix p doesn't make sense any more).

Change CChain::Next() to take reference

To minimize chance of erroneous nullptr dereference, `CChain::Next()`
is changed to take a reference instead of a pointer.
Call sites have been adapted. Notably, NextSyncBlock() now checks
the FindFork() result before calling into Next(), because
the fork lookup may return null.

test: Add CChain basic tests

Add basic unit tests to the `CChain` class, filling a gap.

Co-authored-by: l0rinc <pap.lorinc@gmail.com>

test: Add CChain::FindFork() tests

Add (lengthier) unit tests for `CChain::FindFork()`.

Co-authored-by: l0rinc <pap.lorinc@gmail.com>

Change CChain::Contains() to take reference

The `CChain::Contains()` method dereferences its input without checking,
potentially resulting in nullptr-dereference if invoked with `nullptr`.
To avoid this possibility, its input is changed to a reference instead.
Call sites are adapted accoringly, extra nullptr-check is added as
needed.

net: log SOCKS5 auth before sending

net: cleanup SOCKS5 auth logging

Do not log SOCKS5 auth credentials.

Keep the log entry for the auth path, but omit the
username and password.

No behavior change intended.

tor: torcontrol disconnect on too many lines to avoid OOM

This commit ensures the `TorControlConnection::m_message` buffer doesn't
grow unbounded and exhaust memory, by limiting the number of lines
handled by `TorControlConnection::ProcessBuffer()` to `MAX_LINE_COUNT =
1000`. Now the most memory that can be occupied by `m_message` is on the
order of `MAX_LINE_LENGTH * MAX_LINE_COUNT= 100MB`

Although this is not compliant with the tor control protocol in general,
where commands like `GETINFO ns/all` will likely return thousands of
lines, it is more than sufficient for handling the replies from the
commands that are used by a node:

`AUTHENTICATE`: 1 line:
The server responds with 250 OK on success or 515 Bad
authentication if the authentication cookie is incorrect. Tor closes
the connection on an authentication failure.

https://spec.torproject.org/control-spec/commands.html#authenticate

`GETINFO net/listener/socks`: 2 lines
A quoted, space-separated list of the locations where Tor is
listening...

https://spec.torproject.org/control-spec/commands.html#getinfo

`AUTHCHALLENGE SAFECOOKIE`: 1 line
If the server accepts the command, the server reply format is:

```
"250 AUTHCHALLENGE" SP "SERVERHASH=" ServerHash SP "SERVERNONCE="
ServerNonce CRLF
```

https://spec.torproject.org/control-spec/commands.html#authenticate

`PROTOCOLINFO`: 4-5 lines

The server reply format is:

```
250-PROTOCOLINFO" SP PIVERSION CRLF \*InfoLine "250 OK" CRLF
InfoLine = AuthLine / VersionLine / OtherLine
```

(https://spec.torproject.org/control-spec/commands.html#protocolinfo)

`ADD_ONION`: 2-3 lines for Bitcoin Core's tor control client.

The server reply format is:

```
"250-ServiceID=" ServiceID CRLF
["250-PrivateKey=" KeyType ":" KeyBlob CRLF]
*("250-ClientAuth=" ClientName ":" ClientBlob CRLF)
"250 OK" CRLF
```

...

The server response will only include a private key if the server
was requested to generate a new keypair

...

If client authorization is enabled using the “BasicAuth” flag (which
is v2 only), the service will not be accessible to clients without
valid authorization data (configured with the “HidServAuth” option).
The list of authorized clients is specified with one or more
“ClientAuth” parameters. If “ClientBlob” is not specified for a
client, a new credential will be randomly generated and returned."

https://spec.torproject.org/control-spec/commands.html#add_onion

We don't set the `BasicAuth` flag, so the response will not include any
`ClientAuthLines`.

test: Make torcontrol max line length test stricter and test boundaries.

Adds a check that at the boundary of MAX_LINE_LENGTH, no disconnect
occurs.

Also makes the overlength test message exactly MAX_LINE_LENGTH + 1 to
test the boundary.

Drops the redundant node liveness check, which is covered by the later
check that the node reconnects.

logging: replace BufferedLog with log::Entry

Avoids duplication and ensures timestamp and mocktime are captured
at the same time.

logging: replace FormatLogStrInPlace with Format

Return a new string built left-to-right instead of mutating one
with repeated insert(0, ...). Take a const log::Entry ref since
both call sites now have an Entry available. Also move
LogEscapeMessage inside so callers don't need to pre-escape.

doc: add integer type conventions in btck api remarks

test: interface_http follow-ups

- Only one node needed for test
- Use ascii encoding instead of utf-8
- Make tests independent of each other
- Expect HTTP error code 413 for too-large request
- Clarify python client race condition in comment

kernel: align height parameters to int32_t in btck API

Aligns btck_chain_get_height and btck_chain_get_by_height to use int32_t
for height parameters and return values. Updates the C++ wrapper
accordingly.