What changed, and why it matters
This commit only adds a new test case. It does not change any production code. The test checks that decoding a SegWit-formatted transaction with no witness data correctly produces an error. There is no fix or behavior change in the actual decoder.
No action needed. This is a test-only commit. If reviewing a related security issue, examine the actual decoder implementation and any separate fix commits.
Security signals we found
Test-only change
No production code modified
No patch to decoder logic
Evidence from the diff
The diff adds a unit test decode_segwit_without_witnesses_errors in primitives/src/transaction.rs. It constructs a SegWit-serialized transaction (marker 0001) with one input and zero witnesses, then asserts that TransactionDecoder::push_bytes returns TransactionDecoderErrorInner::NoWitnesses. No implementation code is modified.
Changed components
primitives/src/transaction.rs (tests only)Inspect captured patch +27 / −0
diff --git a/primitives/src/transaction.rs b/primitives/src/transaction.rs
index f3f3651d..2dc0d8b0 100644
--- a/primitives/src/transaction.rs
+++ b/primitives/src/transaction.rs
@@ -2136,4 +2136,31 @@ mod tests {
"a6eab3c14ab5272a58a5ba91505ba1a4b6d7a3a9fcbd187b6cd99a7b6d548cb7".to_string()
);
}
+
+ #[test]
+ #[cfg(all(feature = "alloc", feature = "hex"))]
+ fn decode_segwit_without_witnesses_errors() {
+ // A SegWit-serialized transaction with 1 input but no witnesses for any input.
+ let tx_bytes = hex!(
+ "02000000\
+ 0001\
+ 01\
+ 0000000000000000000000000000000000000000000000000000000000000000\
+ 00000000\
+ 00\
+ ffffffff\
+ 01\
+ 0100000000000000\
+ 00\
+ 00\
+ 00000000"
+ );
+
+ let mut slice = tx_bytes.as_slice();
+ let err = Transaction::decoder()
+ .push_bytes(&mut slice)
+ .expect_err("segwit tx with no witnesses should error");
+
+ assert_eq!(err, TransactionDecoderError(TransactionDecoderErrorInner::NoWitnesses));
+ }
}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.