What the developer wrote
Authored by Salvatore Ingala
Fail immediately if out_len is 0
Avoids potential underflows when later computing out_len - 1
What changed, and why it matters
This commit adds an early safety check in a Bitcoin address formatting function. It returns an error immediately if the output buffer has zero length, preventing a possible integer underflow when the code later computes out_len - 1. The change is defensive and reduces the risk of memory corruption or unexpected behavior, though the commit message only frames it as avoiding underflows and does not claim a specific exploitable vulnerability.
Treat as a low-to-moderate hardening fix. Review all callers of get_script_address() to confirm none pass a zero-length buffer from attacker-influenced input, and consider whether additional length validation is needed elsewhere in the address derivation path.
Security signals we found
Integer underflow prevention on size_t subtraction
Defensive input validation added to public API function
Potential out-of-bounds write risk mitigated
Evidence from the diff
In src/common/script.c, get_script_address() now checks if out_len == 0 and returns -1 before entering the switch statement. The function later uses out_len - 1 when sizing or null-terminating the output string. Without this guard, a zero-length buffer could cause an unsigned integer underflow (size_t wraps to a very large value), potentially leading to out-of-bounds writes. The patch is minimal (+3 lines) and does not show the full call graph or demonstrate an actual trigger path from untrusted input.
Changed components
src/common/script.cget_script_address()Inspect captured patch +3 / −0
diff --git a/src/common/script.c b/src/common/script.c
index cdac1c1..b59cd22 100644
--- a/src/common/script.c
+++ b/src/common/script.c
@@ -74,6 +74,9 @@ int get_script_type(const uint8_t script[], size_t script_len) {
int get_script_address(const uint8_t script[], size_t script_len, char *out, size_t out_len) {
int script_type = get_script_type(script, script_len);
int addr_len;
+
+ if (out_len == 0) return -1;
+
switch (script_type) {
case SCRIPT_TYPE_P2PKH:
case SCRIPT_TYPE_P2SH: {
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.