When a console line begins with ) or is just an empty pair of brackets, RPCParseCommandLine reaches the command-execution branch while the current argument frame is still empty, so stack.back()[0] reads out of bounds and the argument list built from stack.back().begin() + 1 to end() is an invalid iterator range (throws std::length_error in practice, and UBSan flags the null-pointer reference otherwise). The ( branch already guards this with stack.back().size() > 0, so I apply the same check to the ) and newline branch. Added two regression cases to rpcNestedTests that abort without the guard and pass with it.
qt: fix out-of-bounds read in RPCParseCommandLine on empty command #944
pull nabhan06 wants to merge 1 commits into bitcoin-core:master from nabhan06:rpcconsole-empty-stack-oob changing 2 files +3 −1-
nabhan06 commented at 9:34 AM on July 3, 2026: none
-
qt: fix out-of-bounds read in RPCParseCommandLine on empty command fb98a78035
-
DrahtBot commented at 9:34 AM on July 3, 2026: contributor
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--021abf342d371248e50ceaed478a90ca-->
Reviews
See the guideline for information on the review process.
Type Reviewers Concept ACK RandyMcMillan If your review is incorrectly listed, please copy-paste <code><!--meta-tag:bot-skip--></code> into the comment that the bot should ignore.
<!--5faf32d7da4f0f540f40219e4f7537a3-->
-
RandyMcMillan commented at 3:19 PM on July 3, 2026: contributor
Concept ACK
Contributors