From 4a0a3346498afc48eae41a828b4dc78df3c6bc00 Mon Sep 17 00:00:00 2001 From: DanS Date: Mon, 13 Jul 2026 15:56:09 -0500 Subject: [PATCH] fix(consensus): guard NULL pindex deref in hush_validate_chain (crash DoS) hush_validate_chain() enters its body when hush_getblockindex(srchash) returns NULL (via || short-circuit) -- srchash comes from an attacker-controlled notarization OP_RETURN -- then a debug fprintf dereferenced the NULL pindex. A block carrying one crafted OP_RETURN tx crashed every synced node on connect, and crash-looped on restart. Guard the deref: pindex ? GetHeight() : -1. Introduced by Leto commit 4988ce6f2 ("much debug such wow", 2022). Co-Authored-By: Claude Opus 4.8 --- src/hush.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/hush.h b/src/hush.h index 64a4c4064..4863547d7 100644 --- a/src/hush.h +++ b/src/hush.h @@ -510,7 +510,9 @@ int32_t hush_validate_chain(uint256 srchash,int32_t notarized_height) return(0); if ( IsInitialBlockDownload() == 0 && ((pindex= hush_getblockindex(srchash)) == 0 || pindex->GetHeight() != notarized_height) ) { - fprintf(stderr,"%s: Not in IBD, height=%d\n", __func__, pindex->GetHeight() ); + // SECURITY (null-deref crash DoS): this branch is entered when pindex==0 (srchash, taken + // from an attacker-controlled notarization OP_RETURN, is not a known block). Guard the deref. + fprintf(stderr,"%s: Not in IBD, height=%d\n", __func__, pindex != 0 ? pindex->GetHeight() : -1 ); if ( sp->NOTARIZED_HEIGHT > 0 && sp->NOTARIZED_HEIGHT < notarized_height ) rewindtarget = sp->NOTARIZED_HEIGHT - 1; else if ( notarized_height > 101 )