Read out of bounds in main.cpp:3462 #1924

I believe that main.cpp in line 3462 is reading a static buffer out of bounds:

3461 const char* pszDummy = "\0\0"; 3462 CScript scriptDummy(std::vector<unsigned char>(pszDummy, pszDummy + sizeof(pszDummy)));

sizeof(pszDummy) happens to be 8 on a 64-bit environment, and I think the std::vector constructor ends up reading 8 bytes starting from pszDummy, even though this character array contains 3 bytes (the two zero bytes plus the terminating NULL).

I suppose line 3461 was intended to be this instead:

3461 const char pszDummy[] = "\0\0";

However, sizeof(pszDummy) would return 3 now, which includes the terminating NULL, and I do not know whether it was intended for scriptDummy to include all 3 characters or only the 2 zeros...

I think you're right - but it shouldn't have any real effect. The dummy is just used to get past the "coinbase must be at least 2 bytes long" check, and is replaced before anything really uses it anyway.

Good catch!

It's supposed to be simply a two-byte sized zero buffer. There's no need for it to be a zero-terminated string. So let's use

const char pszDummy[] = {0,0};