Summary
Fix critical severity security issue in src/pubkey.cpp.
Vulnerability
| Field | Value |
|---|---|
| ID | V-002 |
| Severity | CRITICAL |
| Scanner | multi_agent_ai |
| Rule | V-002 |
| File | src/pubkey.cpp:160 |
Description: The DER signature parsing code in pubkey.cpp copies the r and s components of an ECDSA signature into a fixed 64-byte stack buffer (tmpsig) using memcpy. The destination offsets are computed as (tmpsig + 32 - rlen) and (tmpsig + 64 - slen). If rlen or slen exceed 32, the arithmetic produces a pointer before the start of the buffer (pointer underflow), writing attacker-controlled bytes to arbitrary stack or heap memory before tmpsig. No bounds check on rlen/slen against the value 32 is present in the reported code.
Changes
src/pubkey.cpp
Verification
- Build passes
- Scanner re-scan confirms fix
- LLM code review passed
Automated security fix by OrbisAI Security
