DragonX/dragonx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(consensus): guard NULL pindex deref in hush_validate_chain (crash DoS)

Browse Source 
hush_validate_chain() enters its body when hush_getblockindex(srchash) returns
NULL (via || short-circuit) -- srchash comes from an attacker-controlled
notarization OP_RETURN -- then a debug fprintf dereferenced the NULL pindex.
A block carrying one crafted OP_RETURN tx crashed every synced node on connect,
and crash-looped on restart. Guard the deref: pindex ? GetHeight() : -1.

Introduced by Leto commit 4988ce6f2 ("much debug such wow", 2022).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
DanS
2026-07-13 15:56:09 -05:00
parent d52550a6fc
commit 4a0a334649
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/hush.h
View File

@@ -510,7 +510,9 @@ int32_t hush_validate_chain(uint256 srchash,int32_t notarized_height)
return(0); return(0);
if ( IsInitialBlockDownload() == 0 && ((pindex= hush_getblockindex(srchash)) == 0 || pindex->GetHeight() != notarized_height) ) if ( IsInitialBlockDownload() == 0 && ((pindex= hush_getblockindex(srchash)) == 0 || pindex->GetHeight() != notarized_height) )
{ {
fprintf(stderr,"%s: Not in IBD, height=%d\n", __func__, pindex->GetHeight() ); // SECURITY (null-deref crash DoS): this branch is entered when pindex==0 (srchash, taken
// from an attacker-controlled notarization OP_RETURN, is not a known block). Guard the deref.
fprintf(stderr,"%s: Not in IBD, height=%d\n", __func__, pindex != 0 ? pindex->GetHeight() : -1 );
if ( sp->NOTARIZED_HEIGHT > 0 && sp->NOTARIZED_HEIGHT < notarized_height ) if ( sp->NOTARIZED_HEIGHT > 0 && sp->NOTARIZED_HEIGHT < notarized_height )
rewindtarget = sp->NOTARIZED_HEIGHT - 1; rewindtarget = sp->NOTARIZED_HEIGHT - 1;
else if ( notarized_height > 101 ) else if ( notarized_height > 101 )