foster/bitcoin-bitcoin-core
0
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-02-02 09:46:52 -05:00
Code Issues Activity

addrman: detect on-disk corrupted nNew and nTried during unserialization

Browse source 
Negative `nNew` or `nTried` are not possible during normal operation.
So, if we read such values during unserialize, report addrman
corruption.

Fixes https://github.com/bitcoin/bitcoin/issues/22450
This commit is contained in:
Vasil Dimov 2021-07-15 13:04:26 +02:00
parent 97153a7026
commit 816f29eab2
No known key found for this signature in database
GPG key ID: 54DF06F64B55CBBF
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/addrman.h
View file

@ -334,12 +334,18 @@ public:
nUBuckets ^= (1 << 30);
}
if (nNew > ADDRMAN_NEW_BUCKET_COUNT * ADDRMAN_BUCKET_SIZE) {
throw std::ios_base::failure("Corrupt CAddrMan serialization, nNew exceeds limit.");
if (nNew > ADDRMAN_NEW_BUCKET_COUNT * ADDRMAN_BUCKET_SIZE || nNew < 0) {
throw std::ios_base::failure(
strprintf("Corrupt CAddrMan serialization: nNew=%d, should be in [0, %u]",
nNew,
ADDRMAN_NEW_BUCKET_COUNT * ADDRMAN_BUCKET_SIZE));
}
if (nTried > ADDRMAN_TRIED_BUCKET_COUNT * ADDRMAN_BUCKET_SIZE) {
throw std::ios_base::failure("Corrupt CAddrMan serialization, nTried exceeds limit.");
if (nTried > ADDRMAN_TRIED_BUCKET_COUNT * ADDRMAN_BUCKET_SIZE || nTried < 0) {
throw std::ios_base::failure(
strprintf("Corrupt CAddrMan serialization: nTried=%d, should be in [0, %u]",
nTried,
ADDRMAN_TRIED_BUCKET_COUNT * ADDRMAN_BUCKET_SIZE));
}
// Deserialize entries from the new table.