Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid app crashing on certain malformed PSBTs on legacy inputs #223

Merged
merged 2 commits into from
Feb 6, 2024
Merged

Avoid app crashing on certain malformed PSBTs on legacy inputs #223

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aac2e7a
Make sure that legacy inputs do not have witness-utxo in the psbt
bigspider Feb 5, 2024
bdcbe1b
Avoid sending a status word twice on failure, which would cause an ap…
bigspider Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions src/handler/sign_psbt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -969,10 +969,14 @@ preprocess_inputs(dispatcher_context_t *dc,
int segwit_version = get_policy_segwit_version(st->wallet_policy_map);

// For legacy inputs, the non-witness utxo must be present
if (segwit_version == -1 && !input.has_nonWitnessUtxo) {
PRINTF("Non-witness utxo missing for legacy input\n");
SEND_SW(dc, SW_INCORRECT_DATA);
return false;
// and the witness utxo must be absent.
// (This assumption is later relied on when signing).
if (segwit_version == -1) {
if (!input.has_nonWitnessUtxo || input.has_witnessUtxo) {
PRINTF("Legacy inputs must have the non-witness utxo, but no witness utxo.\n");
SEND_SW(dc, SW_INCORRECT_DATA);
return false;
}
}

// For segwitv0 inputs, the non-witness utxo _should_ be present; we show a warning
Expand Down Expand Up @@ -2469,10 +2473,12 @@ sign_transaction(dispatcher_context_t *dc,
return false;

if (!sign_transaction_input(dc, st, &hashes, &placeholder_info, &input, i)) {
SEND_SW(dc, SW_BAD_STATE); // should never happen
if (!G_swap_state.called_from_swap) {
ui_post_processing_confirm_transaction(dc, false);
}

// we do not send a status word, since sign_transaction_input
// already does it on failure
return false;
}
}
Expand Down
Loading