compressor: oversized script decoding can leave a spendable script #36386

pull l0rinc wants to merge 2 commits into bitcoin:master from l0rinc:l0rinc/script-compression-replace-oversized changing 2 files +14 −1

l0rinc commented at 1:25 AM on September 30, 2026: contributor

Problem: The oversized-script fallback appends OP_RETURN to the destination instead of replacing it. If the destination already contains an unfinished push, the appended byte becomes pushed data and the result can remain spendable.

Fix: Replace the destination with OP_RETURN rather than appending it.

Found while reviewing #36280. This predates that PR and appears latent because oversized outputs are excluded from the UTXO set, but it could affect malformed stored records decoded into a reused destination.
DrahtBot commented at 1:25 AM on September 30, 2026: contributor


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



External sites
- Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36386
- Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36386.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36386#author-ralph


Reviews

See the guideline and AI policy for information on the review process.

Type Reviewers

ACK jcastros

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.



Conflicts

Reviewers, this pull request conflicts with the following ones:
- #36280 <sub><img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36280.svg"></sub> (validation: throw when a compressed script can't be decompressed by furszy)
- #36074 <sub><img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36074.svg"></sub> (scripted-diff: [test] Add util/check.h includes for assertions by maflcko)
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.
l0rinc force-pushed on Sep 30, 2026
DrahtBot added the label CI failed on Sep 30, 2026
DrahtBot removed the label CI failed on Sep 30, 2026
maflcko commented at 7:58 AM on September 30, 2026: member

it could affect malformed stored records decoded into a reused destination.

Not sure, reusing a destination would be an unrelated bug? So I am half suggesting to drop the test in a third commit again, or at least clarify in the comment that this isn't supposed to test any real production behavior.

lgtm either way.

Type	Reviewers
ACK	jcastros

test: characterize oversized script decoding into a reused target

Decode an oversized script into a target containing an incomplete push.
Record that the resulting script fails IsUnspendable().
The following fix requires the decoded script to be unspendable.

11494efb01

compressor: replace oversized scripts instead of appending

The oversized-script fallback appends OP_RETURN to the destination rather than replacing it as documented.
A reused target retains its previous contents, and an incomplete push can consume OP_RETURN as data.
Assign a new OP_RETURN script before skipping the oversized payload so the result is independent of the destination's prior contents.

f313faff44

l0rinc force-pushed on Sep 30, 2026
l0rinc commented at 6:12 PM on September 30, 2026: contributor

Not sure, reusing a destination would be an unrelated bug?

We do have some existing reuses, e.g. in https://github.com/bitcoin/bitcoin/blob/e7aef7e86da79000aa42f5ba6d13b0d123d9da7c/src/rpc/blockchain.cpp#L3435-L3462 the snapshot export reuses the same Coin in the loop. Regardless, added a comment clarifying that this tests the fallback directly, since normal UTXO insertion excludes oversized scripts.
jcastros commented at 3:27 PM on October 5, 2026: none

Tested ACK f313faff443e5cdbd858a54c6bb939799d7ce714

I built test_bitcoin (GCC 13.3, RelWithDebInfo) and ran compress_tests on this and on 11494efb01d0. Both are clean. Putting script << OP_RETURN back makes compress_oversized_script fail, so the new check covers the fix.

Contributors

Linked (view graph)

#36280 validation: throw when a compressed script can't be decompressed

compressor: oversized script decoding can leave a spendable script #36386

External sites

Reviews

Conflicts