Test: Add P2SH scriptSig stack-size boundary tests #36465

pull benthecarman wants to merge 2 commits into bitcoin:master from benthecarman:p2sh-stack-size-boundary changing 2 files +19 −0

benthecarman commented at 5:59 AM on October 8, 2026: contributor

VerifyScript runs a P2SH scriptPubKey on the stack the scriptSig leaves before handling the redeemScript. The 20-byte push in HASH160 <20> EQUAL adds one item, so a scriptSig that leaves 1,000 items fails with STACK_SIZE, while 999 items is valid.

An implementation that checks the redeemScript hash without running the scriptPubKey accepts the 1,000-item spend. No existing vector leaves the scriptSig at this boundary, so such an implementation can pass every row.

Add 999 and 1,000 item cases with P2SH and WITNESS, and the 1,000 item case with no flags, which fails the same way because the scriptPubKey always runs.

Also add the case as a feature_taproot spender, so its dump can be added to the script assets (bitcoin-core/qa-assets#297).

These were discovered by finding gaps in an alternate implementation (rbitcoin)
DrahtBot added the label Tests on Oct 8, 2026
DrahtBot commented at 5:59 AM on October 8, 2026: contributor


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



External sites
- Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36465
- Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36465.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36465#author-ralph


Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.
brunoerg commented at 12:30 PM on October 8, 2026: contributor

Can you please remove the LLM as co-author? See AI policy

Test: Add P2SH scriptSig stack-size boundary tests

VerifyScript runs a P2SH scriptPubKey on the stack the scriptSig
leaves before handling the redeemScript. The 20-byte push in
HASH160 <20> EQUAL adds one item, so a scriptSig that leaves 1,000
items fails with STACK_SIZE, while 999 items is valid.

An implementation that checks the redeemScript hash without running
the scriptPubKey accepts the 1,000-item spend. No existing vector
leaves the scriptSig at this boundary, so such an implementation can
pass every row.

Add 999 and 1,000 item cases with P2SH and WITNESS, and the 1,000
item case with no flags, which fails the same way because the
scriptPubKey always runs.

6002e8c70f

benthecarman force-pushed on Oct 8, 2026

Test: Add P2SH stack size case to taproot test

Add a feature_taproot spender whose P2SH scriptSig leaves 999 items
on success and 1,000 on failure. The scriptPubKey runs on that stack,
and its 20-byte push makes the 1,000-item spend exceed the stack size
limit. An implementation that only compares the redeemScript hash
accepts it.

Naming the case lets its dump be added to the script assets.

2ba00d5b5d

DrahtBot added the label CI failed on Oct 8, 2026
DrahtBot removed the label CI failed on Oct 8, 2026

Contributors

Labels

Test: Add P2SH scriptSig stack-size boundary tests #36465

External sites

Reviews