From 6380180821917c22ecfd89128ee60aae6f4cac33 Mon Sep 17 00:00:00 2001 From: Peter Todd Date: Mon, 10 Mar 2014 17:36:35 -0400 Subject: Add rejection of non-null CHECKMULTISIG dummy values This is a source of transaction mutability as the dummy value was previously not checked and could be modified to something other than the usual OP_0 value. --- src/script.cpp | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'src/script.cpp') diff --git a/src/script.cpp b/src/script.cpp index dc0cd28bf..a5cdc9712 100644 --- a/src/script.cpp +++ b/src/script.cpp @@ -934,8 +934,22 @@ bool EvalScript(vector >& stack, const CScript& script, co fSuccess = false; } - while (i-- > 0) + // Clean up stack of actual arguments + while (i-- > 1) popstack(stack); + + // A bug causes CHECKMULTISIG to consume one extra argument + // whose contents were not checked in any way. + // + // Unfortunately this is a potential source of mutability, + // so optionally verify it is exactly equal to zero prior + // to removing it from the stack. + if (stack.size() < 1) + return false; + if ((flags & SCRIPT_VERIFY_NULLDUMMY) && stacktop(-1).size()) + return error("CHECKMULTISIG dummy argument not null"); + popstack(stack); + stack.push_back(fSuccess ? vchTrue : vchFalse); if (opcode == OP_CHECKMULTISIGVERIFY) -- cgit v1.2.3