Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Relax witness size checking #103

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Conversation

roylee17
Copy link
Collaborator

@roylee17 roylee17 commented May 2, 2023

this is a response to @nikooo777's inqury about CVE-2022-44797
and CVE-2022-39389

At the moment, I don't have enough bandwidth to further investigate if lbcd is impacted, but it seems fine as we only have two implementations (lbcd and lbrycrd), and both have the same witness-size-checking.

Roasbeef and others added 2 commits May 1, 2023 15:01
In this commit, we fix a bug that would cause nodes to be unable to
parse a given block from the wire. The block would be properly accepted
if fed in via other mechanisms.

The issue here is that the old checks for the maximum witness size,
circa segwit v0 where placed in the wire package _as well_ as the tx
engine. This check should only be in the engine, since it's properly
gated by other related scrip validation flags.

The fix itself is simple: limit witnesses only based on the maximum
block size in bytes, or ~4MB.
@coveralls
Copy link

coveralls commented May 2, 2023

Pull Request Test Coverage Report for Build 4857496858

Details

  • 3 of 3 (100.0%) changed or added relevant lines in 1 file are covered.
  • 8 unchanged lines in 1 file lost coverage.
  • Overall coverage decreased (-0.02%) to 51.09%

Files with Coverage Reduction New Missed Lines %
peer/peer.go 8 75.14%
Totals Coverage Status
Change from base Build 3534043008: -0.02%
Covered Lines: 22490
Relevant Lines: 44020

💛 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants