docs: note `ScriptBuf` and `script::Builder` panic behavior
What the developer wrote
Authored by Daniel Roberts
docs: note `ScriptBuf` and `script::Builder` panic behavior
What changed, and why it matters
This commit only adds documentation comments explaining that two Rust Bitcoin types can panic if someone tries to create a script larger than about 2 billion bytes. No code behavior was changed, so it does not fix or introduce a security vulnerability by itself.
No action required; treat as routine documentation update. If reviewing a larger patch series, verify whether the panic behavior itself is being addressed elsewhere.
Security signals we found
No functional code changes
Documentation-only commit
Mentions pre-existing panic behavior inherited from Rust Vec capacity limits
Evidence from the diff
The commit adds # Panics doc sections to script::Builder and ScriptBuf noting that they inherit Vec’s panic behavior when a script exceeds isize::MAX bytes. The diff is +10/-0 across two files and contains no functional changes. It is purely a documentation/clarity improvement.
Changed components
bitcoin/src/blockdata/script/builder.rsprimitives/src/script/owned.rsInspect captured patch +10 / −0
diff --git a/bitcoin/src/blockdata/script/builder.rs b/bitcoin/src/blockdata/script/builder.rs
index 2a479d6a..34342ec3 100644
--- a/bitcoin/src/blockdata/script/builder.rs
+++ b/bitcoin/src/blockdata/script/builder.rs
@@ -12,6 +12,11 @@ use crate::script::{ScriptBufExt as _, ScriptBufExtPriv as _, ScriptExtPriv as _
use crate::{relative, Sequence};
/// An Object which can be used to construct a script piece by piece.
+///
+/// # Panics
+///
+/// `Builder` is backed by [`ScriptBuf`] and inherits its panic behavior. This means that
+/// attempting to construct scripts larger than `isize::MAX` bytes will panic.
#[derive(PartialEq, Eq, Clone)]
pub struct Builder<T>(ScriptBuf<T>, Option<Opcode>);
diff --git a/primitives/src/script/owned.rs b/primitives/src/script/owned.rs
index 45e289c9..fcb1d67a 100644
--- a/primitives/src/script/owned.rs
+++ b/primitives/src/script/owned.rs
@@ -27,6 +27,11 @@ use crate::prelude::{Box, Vec};
///
/// [`examples/script.rs`]: <https://github.com/rust-bitcoin/rust-bitcoin/blob/master/bitcoin/examples/script.rs>
/// [deref coercions]: https://doc.rust-lang.org/std/ops/trait.Deref.html#more-on-deref-coercion
+///
+/// # Panics
+///
+/// `ScriptBuf` is backed by [`Vec`] and inherits its panic behavior. This means that attempting to
+/// construct scripts larger than `isize::MAX` bytes will panic.
#[derive(Clone, PartialOrd, Ord, PartialEq, Eq, Hash)]
pub struct ScriptBuf<T>(PhantomData<T>, Vec<u8>);
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.