foster/bitcoin-bitcoin-core
0
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-02-08 10:31:50 -05:00
Code Issues Activity
Bitcoin Core integration/staging tree
26168 commits 6 branches 321 tags 2.3 GiB
C++ 56.4%
C 22.7%
Python 17.6%
CMake 1%
Shell 0.8%
Other 1.3%
Find a file
fanquake 9af7c1993b
Merge #20216: wallet: fix buffer over-read in SQLite file magic check 
56a461f727 wallet: fix buffer over-read in SQLite file magic check (Sebastian Falbesoner)

Pull request description:

  Looking at our new SQLite database code, I noticed that there is a potential problem in the method `IsSQLiteFile()`:  If there is no terminating zero within the first 16 bytes of the file, the `magic` buffer would be over-read in the `std::string` constructor for `magic_str`. Fixed by using the "from buffer" variant of the string ctor (that also takes a size) rather than the "from c-string" variant (see http://www.cplusplus.com/reference/string/string/string/).

  The behaviour can be reproduced by the following steps:
  * Creating a file of at least 512 bytes in size (to pass the minimum size check) that doesn't contain zero bytes in the magic area, e.g. simply:
  `$ python3 -c "print('A'*512)" > /tmp/corrupt_wallet`
  * Showing content and size of the `magic_str` string in case the magic check fails
  * Create a simple unit test that simply calls `IsSQLiteFile` with the corrupt wallet file
  * Run the unit test and see the random gibberish output of `magic_str` after 16 `A`s :-)

  Or, TLDR variant, just get the branch https://github.com/theStack/bitcoin/tree/reproduce_sqlite_magic_overread, compile unit Tests and run the script `./reproduce_sqlite_magic_overread.sh`.

  Note that this is the minimal diff, probably it would be better to avoid `std::string` at all in this case and just use `memcmp`, strings that include null bytes are pretty confusing.

ACKs for top commit:
  promag:
    Code review ACK 56a461f727.
  practicalswift:
    ACK 56a461f727: patch looks correct
  achow101:
    ACK 56a461f727

Tree-SHA512: a7aadd4d38eb92337e6281df2980f4bde744dbb6cf112b9cd0f2cab8772730e302db9123a8fe7ca4e7e844c47e68957487adb2bed4518c40b4bed6a69d7922b4
2020-10-23 10:10:54 +08:00
.github doc: Remove label from good first issue template 2020-08-24 09:31:24 +02:00
.tx tx: Update transifex slug for 0.21 2020-10-01 22:19:11 +02:00
build-aux/m4 build: AX_PTHREAD serial 27 2020-09-14 16:35:09 +08:00
build_msvc Merge #19953: Implement BIP 340-342 validation (Schnorr/taproot/tapscript) 2020-10-15 10:22:35 +02:00
ci Merge #19953: Implement BIP 340-342 validation (Schnorr/taproot/tapscript) 2020-10-15 10:22:35 +02:00
contrib contrib: Fix gen_key_io_test_vectors.py imports 2020-10-16 13:48:17 +02:00
depends Add sqlite to travis and depends 2020-10-14 11:18:13 -04:00
doc doc: Merge release notes 2020-10-19 12:00:16 +02:00
share doc: Use precise permission flags where possible 2020-07-10 15:37:42 +02:00
src Merge #20216: wallet: fix buffer over-read in SQLite file magic check 2020-10-23 10:10:54 +08:00
test Merge #20112: test: Speed up wallet_resendwallettransactions with mockscheduler RPC 2020-10-22 14:18:06 +02:00
.appveyor.yml Bump vcpkg commit ID to get new msys mirror list 2020-10-06 19:17:53 +01:00
.cirrus.yml cirrus: Use kvm to avoid spurious CI failures in the default virtualization cluster 2020-10-08 14:47:21 +02:00
.fuzzbuzz.yml ci: Add fuzzbuzz integration 2020-04-14 16:38:26 +00:00
.gitattributes Separate protocol versioning from clientversion 2014-10-29 00:24:40 -04:00
.gitignore .gitignore: ignore qa-assets/ folder 2020-09-08 02:47:53 -04:00
.python-version .python-version: Specify full version 3.5.6 2019-03-02 12:06:26 -05:00
.style.yapf test: .style.yapf: Set column_limit=160 2019-03-04 18:28:13 -05:00
.travis.yml Squashed 'src/secp256k1/' changes from 8ab24e8dad..c6b6b8f1bb 2020-10-14 11:41:15 -07:00
autogen.sh scripted-diff: Bump copyright of files changed in 2019 2019-12-30 10:42:20 +13:00
CODEOWNERS doc: Add comments and additional reviewers to CODEOWNERS file 2020-09-01 11:23:58 -04:00
configure.ac Merge #19953: Implement BIP 340-342 validation (Schnorr/taproot/tapscript) 2020-10-15 10:22:35 +02:00
CONTRIBUTING.md Replace hidden service with onion service 2020-08-07 14:55:02 +02:00
COPYING doc: Update license year range to 2020 2019-12-26 23:11:21 +01:00
INSTALL.md Update INSTALL landing redirection notice for build instructions. 2016-10-06 12:27:23 +13:00
libbitcoinconsensus.pc.in build: remove libcrypto as internal dependency in libbitcoinconsensus.pc 2019-11-19 15:03:44 +01:00
Makefile.am build: use DIR_FUZZ_SEED_CORPUS if specified for cov_fuzz target 2020-09-08 02:45:42 -04:00
README.md Squashed 'src/secp256k1/' changes from 8ab24e8dad..c6b6b8f1bb 2020-10-14 11:41:15 -07:00
SECURITY.md doc: Remove explicit mention of version from SECURITY.md 2019-06-14 06:39:17 -04:00

README.md

Bitcoin Core integration/staging tree

https://bitcoincore.org

What is Bitcoin?

Bitcoin is an experimental digital currency that enables instant payments to anyone, anywhere in the world. Bitcoin uses peer-to-peer technology to operate with no central authority: managing transactions and issuing money are carried out collectively by the network. Bitcoin Core is the name of open source software which enables the use of this currency.

For more information, as well as an immediately usable, binary version of the Bitcoin Core software, see https://bitcoincore.org/en/download/, or read the original whitepaper.

License

Bitcoin Core is released under the terms of the MIT license. See COPYING for more information or see https://opensource.org/licenses/MIT.

Development Process

The master branch is regularly built (see doc/build-*.md for instructions) and tested, but it is not guaranteed to be completely stable. Tags are created regularly from release branches to indicate new official, stable release versions of Bitcoin Core.

The https://github.com/bitcoin-core/gui repository is used exclusively for the development of the GUI. Its master branch is identical in all monotree repositories. Release branches and tags do not exist, so please do not fork that repository unless it is for development reasons.

The contribution workflow is described in CONTRIBUTING.md and useful hints for developers can be found in doc/developer-notes.md.

Testing

Testing and code review is the bottleneck for development; we get more pull requests than we can review and test on short notice. Please be patient and help out by testing other people's pull requests, and remember this is a security-critical project where any mistake might cost people lots of money.

Automated Testing

Developers are strongly encouraged to write unit tests for new code, and to submit new unit tests for old code. Unit tests can be compiled and run (assuming they weren't disabled in configure) with: make check. Further details on running and extending unit tests can be found in /src/test/README.md.

There are also regression and integration tests, written in Python, that are run automatically on the build server. These tests can be run (if the test dependencies are installed) with: test/functional/test_runner.py

The Travis CI system makes sure that every pull request is built for Windows, Linux, and macOS, and that unit/sanity tests are run automatically.

Manual Quality Assurance (QA) Testing

Changes should be tested by somebody other than the developer who wrote the code. This is especially important for large or high-risk changes. It is useful to add a test plan to the pull request description if testing the changes is not straightforward.

Translations

Changes to translations as well as new translations can be submitted to Bitcoin Core's Transifex page.

Translations are periodically pulled from Transifex and merged into the git repository. See the translation process for details on how this works.

Important: We do not accept translation changes as GitHub pull requests because the next pull from Transifex would automatically overwrite them again.

Translators should also subscribe to the mailing list.