Merge bitcoin/bitcoin#35873: test: add a tx_valid vector for CVE-2024-38365
What the developer wrote
Authored by merge-script
Merge bitcoin/bitcoin#35873: test: add a tx_valid vector for CVE-2024-38365
6cd2fa5fb4b6d25b8400d2a7683ceb78610c0b4f test: add a tx_valid vector for CVE-2024-38365 (JP)
Pull request description:
Suggested by darosior in #35835.
`FindAndDelete` only matches whole pushes at opcode boundaries, so a push that carries the signature inside its data is left in the scriptCode. btcd (<0.24.2) removed any push containing the signature, computed a different sighash, and would have rejected a transaction Core accepts: the chain split in [CVE-2024-38365](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184).
The rule is already covered from the failure side, in `script_FindAndDelete` and in the `tx_invalid.json` vectors where the signature sits under a non-standard pushdata prefix. What was missing is the positive direction: a transaction Core must accept because nothing is deleted.
This adds one vector to `tx_valid.json`, with `OP_CHECKSIGVERIFY <0xaaaa||sig>` as the P2SH redeemScript and the minimal 8-byte DER signature (r = s = 1). The pubkey is recovered from that signature and the sighash Core computes, so it verifies only if the `<0xaaaa||sig>` push survives into the scriptCode. `CONST_SCRIPTCODE` doesn't fire — `FindAndDelete` finds nothing — and the vector runs with every flag.
To check it actually discriminates, I patched `EvalChecksigPreTapscript` to drop any push whose data contains the signature, the way btcd did. The vector fails with that patch and passes without it.
Tested with:
```
build/bin/test_bitcoin --run_test=transaction_tests
```
ACKs for top commit:
fametrano:
ACK 6cd2fa5fb4b6d25b8400d2a7683ceb78610c0b4f
sedited:
ACK 6cd2fa5fb4b6d25b8400d2a7683ceb78610c0b4f
Tree-SHA512: a08412e00ed43570c3cf556da1d243a40b9684ce17eb6d3017267c3e5e82f9cde232e077944b0ec9476df70e767caf0fcd33be5473dfd53ed2241f7b24a33b1d
What changed, and why it matters
This commit only adds a new test case to Bitcoin Core's transaction validation test data. The test confirms that Bitcoin Core correctly handles a specific signature-checking quirk that caused a bug in another Bitcoin implementation (btcd). It does not change any production code, so it cannot by itself introduce a vulnerability or fix one in Bitcoin Core. It is a regression-style test for a known, already-disclosed issue (CVE-2024-38365).
No action required. Review the test vector for correctness if auditing test coverage, but this commit is not a security patch and does not require deployment urgency.
Security signals we found
References CVE-2024-38365 in commit title and test comments
Adds a positive tx_valid test vector for FindAndDelete behavior
No changes to consensus, script, or P2P code
Test-only change with no runtime behavior change
Evidence from the diff
The commit adds one tx_valid.json vector for CVE-2024-38365. The vector uses a P2SH redeemScript containing OP_CHECKSIGVERIFY followed by a push of <0xaaaa||sig>. Because Bitcoin Core’s FindAndDelete only removes exact whole-push signature matches at opcode boundaries, the push remains in the scriptCode and the sighash is computed correctly. The public key is recovered from the minimal DER signature so verification succeeds only under Core’s rules. The commit is purely a test addition; no consensus or script-evaluation code is modified.
Changed components
src/test/data/tx_valid.jsontransaction_tests (test suite)Inspect captured patch +7 / −0
### src/test/data/tx_valid.json
@@ -524,5 +524,12 @@
[[["1111111111111111111111111111111111111111111111111111111111111111", 0, "0x00 0x14 0x751e76e8199196d454941c45d1b3a323f1433bd6", 5000000]],
"0100000000010111111111111111111111111111111111111111111111111111111111111111110000000000ffffffff0130244c0000000000fd02014cdc1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111175210279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798ac02483045022100c1a4a6581996a7fdfea77d58d537955a5655c1d619b6f3ab6874f28bb2e19708022056402db6fede03caae045a3be616a1a2d0919a475ed4be828dc9ff21f24063aa01210279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f8179800000000", "NONE"],
+["CVE-2024-38365: FindAndDelete only matches whole pushes at opcode boundaries"],
+["The redeemScript pushes <0xaaaa || sig>, which contains the signature but is not an exact match,"],
+["so the push stays in the scriptCode. btcd <0.24.2 removed any push containing the signature and"],
+["computed a different sighash. The pubkey is recovered so the sig only verifies under Core rules."],
+[[["0000000000000000000000000000000000000000000000000000000000000100", 0, "HASH160 0x14 0x5374555595f7f3032fa3b70993507f15e5872e91 EQUAL"]],
+"02000000010001000000000000000000000000000000000000000000000000000000000000000000003a0930060201010201010121030df5ae00a6f068126f44608b8b5d0b0bde41a8316e3d765815e76de897362a470dad0baaaa300602010102010101ffffffff010000000000000000016a00000000", "NONE"],
+
["Make diffs cleaner by leaving a comment here without comma at the end"]
]Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.