wallet: validate descriptor cache xpub length before decoding #35672

pull nabhan06 wants to merge 1 commits into bitcoin:master from nabhan06:wallet-descriptor-cache-xpub-length changing 2 files +53 −2

nabhan06 commented at 6:32 AM on July 7, 2026: none

guard both descriptor-cache loaders in LoadDescriptorWalletRecords so a wallet record whose serialized xpub is shorter than BIP32_EXTKEY_SIZE is rejected as corrupt instead of having CExtPubKey::Decode read a fixed 74 bytes past the end of the deserialized buffer, matching the length check key_io already does before Decode.
wallet: validate descriptor cache xpub length before decoding 975e014c71
DrahtBot added the label Wallet on Jul 7, 2026
DrahtBot commented at 6:32 AM on July 7, 2026: contributor



The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35672.



Reviews

See the guideline for information on the review process.

Type Reviewers

Concept ACK pablomartin4btc

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.

Type	Reviewers
Concept ACK	pablomartin4btc

in src/wallet/test/walletload_tests.cpp:124 in 975e014c71

 119 | +    }
 120 | +    {
 121 | +        // Write a parent-cache record whose value is a truncated xpub.
 122 | +        std::unique_ptr<DatabaseBatch> batch = database->MakeBatch();
 123 | +        const std::vector<unsigned char> truncated_xpub(BIP32_EXTKEY_SIZE - 1, 0);
 124 | +        BOOST_CHECK(batch->Write(std::make_pair(std::make_pair(std::string{"walletdescriptorcache"}, desc_id), uint32_t{0}), truncated_xpub));

pablomartin4btc commented at 7:04 AM on July 7, 2026:

Perhaps better to use DBKeys::WALLETDESCRIPTORCACHE const directly instead of hardcoded string... (it needs to be declared as extern in walletdb.h)

        BOOST_CHECK(batch->Write(std::make_pair(std::make_pair(DBKeys::WALLETDESCRIPTORCACHE, desc_id), uint32_t{0}), truncated_xpub));

pablomartin4btc commented at 7:12 AM on July 7, 2026: member

Concept ACK

The second fix (the WALLETDESCRIPTORLHCACHE path) has no test.
maflcko commented at 7:52 AM on July 7, 2026: member

ai slop.

Instead of creating an exact duplicate of a pre-existing pull request, it would be better to just leave your review on the existing pull request.
maflcko closed this on Jul 7, 2026

Contributors

Labels

wallet: validate descriptor cache xpub length before decoding #35672

Code Coverage & Benchmarks

Reviews