{ "number": 36386, "input_hash": "a94dcf6b3cf12e97", "model": "ledger", "prompt_hash": null, "created": "2026-10-28T01:24:45+00:00", "result": { "summary": "Replaces the destination script with a fresh OP_RETURN script instead of appending to it when decompressing an oversized script. A unit test is added to verify that decompressing an oversized script into a reused destination containing an incomplete push produces an unspendable script.", "problem": "When decoding an oversized script into a reused script buffer, appending OP_RETURN with operator<< retains prior buffer contents. If the buffer has an incomplete push, the OP_RETURN byte is treated as push data instead of an unspendable opcode, potentially leaving the script spendable.", "card": "Fixes a latent bug in script decompression where handling an oversized script appends OP_RETURN to the destination buffer rather than replacing it. If the destination buffer is reused and contains an unfinished data push, the appended opcode is treated as push data rather than an unspendable opcode, leaving the script spendable. The author notes that oversized scripts are excluded from the UTXO set during validation, making the issue latent unless malformed records are decoded into reused buffers.", "evidence": [ "PR description: 'Found while reviewing #36280. This predates that PR and appears latent because oversized outputs are excluded from the UTXO set, but it could affect malformed stored records decoded into a reused destination.'" ], "scope_notes": "", "changed_since_previous": "No functional changes to the fix or test; commits appear reorganized to separate the test characterization from the implementation fix.", "thread": { "last_event_at": "2026-10-27T14:40:12Z", "events": 16, "head_sha": "426f29c3f1639e4c97be63cdf4c2e76bb86b39dd", "schema_floor": 2, "schema": 2 }, "waiting_on": [ { "at": "2026-10-27", "id": "c:6444909520", "on": "author", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-6444909520", "what": "answer optout21's review comments" }, { "at": "2026-10-26", "id": "rc:4376274486", "on": "author", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4376274486", "what": "consider hodlinator's compile-time hex literal nit" } ], "risk": { "level": "low", "touches": [ "validation" ], "why": "Touches UTXO script decompression logic, but oversized scripts are prevented from entering the UTXO database by standard validation rules and the change strictly enforces unspendability." }, "discussion": { "author_status": "last statement processed 2026-10-27", "open_concerns": [ "hodlinator: Compute the incomplete push script at compile time using hex literal", "optout21: Whether the script output variable could be cleared at the beginning of DecompressScript" ], "resolved_concerns": [ "maflcko: Drop the test or clarify in a comment that it does not test real production behavior (answered by l0rinc 2026-09-30)", "hodlinator: Simplify the test stream expression and avoid the redundant CScript constructor call (accepted by hodlinator 2026-10-26)", "hodlinator: Verify restored starts out spendable before the compression round-trip makes it unspendable (accepted by hodlinator 2026-10-26)", "hodlinator: Pin down the exact resulting script in the test with BOOST_CHECK_EQUAL_COLLECTIONS (accepted by hodlinator 2026-10-26)", "optout21: Adjust the 0x04/0x05 error codepath in DecompressScript or soften the commit message claim that the result is independent of prior contents (accepted by optout21 2026-10-27)" ] }, "reviewability": { "state": "Ready", "label": "Ready", "reason": "Nothing known that would invalidate a review now." }, "agreement": { "state": "Strong", "summary": "Strong: substantive support, no open objection (jcastros, fametrano, optout21)", "reason": "Added ACKs from maflcko and optout21. Recorded optout21's review comments regarding destination independence in DecompressScript, with the question on clearing script open and the codepath adjustment suggestion dropped.", "evidence": [ "hodlinator (suggestion, style, must be answered, open): Compute the incomplete push script at compile time using hex literal", "optout21 (question, approach, must be answered, open): Whether the script output variable could be cleared at the beginning of DecompressScript", "maflcko: support \u2014 lgtm either way", "jcastros: Tested ACK \u2014 built test_bitcoin, ran compress_tests on both commits, and verified reverting the change causes compress_oversized_script to fail", "hodlinator: Concept ACK \u2014 Concept ACK f313faff443e5cdbd858a54c6bb939799d7ce714", "fametrano: Tested ACK \u2014 decoded 1307 compressed scripts into fresh and reused targets against an independent library and verified all raw and oversized decodes match", "hodlinator: ACK \u2014 ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd", "maflcko: ACK \u2014 review ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd", "optout21: ACK \u2014 This change is a net improvement, independent of #36280" ], "objections": [ { "reviewer": "maflcko", "association": "MEMBER", "type": "suggestion", "kind": "approach", "harm": "", "request": "Drop the test or clarify in a comment that it does not test real production behavior", "question": "", "text": "Drop the test or clarify in a comment that it does not test real production behavior", "clears_with": "answer", "blocking": false, "status": "answered", "status_note": "author pointed to existing destination reuse in snapshot export and added clarifying comment to the test", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": true, "replies": [ "c:5917022886" ], "evidence": "2026-09-30: 'I am half suggesting to drop the test in a third commit again, or at least clarify in the comment that this isn't supposed to test any real production behavior.'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-5906809717", "id": "c:5906809717", "at": "2026-09-30", "status_at": "2026-09-30", "status_by": "l0rinc", "resolution_evidence": "2026-09-30: l0rinc: 'Regardless, added a comment clarifying that this tests the fallback directly, since normal UTXO insertion excludes overs'", "pin": null, "from_schema": 2 }, { "reviewer": "hodlinator", "association": "MEMBER", "type": "suggestion", "kind": "style", "harm": "", "request": "Simplify the test stream expression and avoid the redundant CScript constructor call", "question": "", "text": "Simplify the test stream expression and avoid the redundant CScript constructor call", "clears_with": "answer", "blocking": false, "status": "accepted", "status_note": "dropped in approving review r:5650692444", "cleared": true, "author_replied": false, "others_replied": false, "fix_pushed": false, "replies": [], "evidence": "2026-10-14: 'This has a bit too much happening at once IMO (+ redundant `CScript`-ctor-call). Would rather have something closer to'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4269121804", "id": "rc:4269121804", "at": "2026-10-14", "status_at": "2026-10-26", "status_by": "hodlinator", "resolution_evidence": "2026-10-26: hodlinator: 'ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd'", "pin": null, "from_schema": 2 }, { "reviewer": "hodlinator", "association": "MEMBER", "type": "suggestion", "kind": "approach", "harm": "", "request": "Verify restored starts out spendable before the compression round-trip makes it unspendable", "question": "", "text": "Verify restored starts out spendable before the compression round-trip makes it unspendable", "clears_with": "answer", "blocking": false, "status": "accepted", "status_note": "implemented in push and accepted in approving review r:5650692444", "cleared": true, "author_replied": false, "others_replied": false, "fix_pushed": true, "replies": [], "evidence": "2026-10-14: 'nit: Could verify that `restored` starts out spendable before the compression round-trip makes it unspendable?'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4269144356", "id": "rc:4269144356", "at": "2026-10-14", "status_at": "2026-10-26", "status_by": "hodlinator", "resolution_evidence": "2026-10-26: hodlinator: 'ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd'", "pin": null, "from_schema": 2 }, { "reviewer": "hodlinator", "association": "MEMBER", "type": "suggestion", "kind": "approach", "harm": "", "request": "Pin down the exact resulting script in the test with BOOST_CHECK_EQUAL_COLLECTIONS", "question": "", "text": "Pin down the exact resulting script in the test with BOOST_CHECK_EQUAL_COLLECTIONS", "clears_with": "answer", "blocking": false, "status": "accepted", "status_note": "dropped in approving review r:5650692444", "cleared": true, "author_replied": false, "others_replied": false, "fix_pushed": false, "replies": [], "evidence": "2026-10-14: 'Ralph suggested also pinning down the resulting script (https://git.fish.foo/bitcoin/bitcoin/pulls/36386#issuecomment-608275), which seems fair enough.'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4269186201", "id": "rc:4269186201", "at": "2026-10-14", "status_at": "2026-10-26", "status_by": "hodlinator", "resolution_evidence": "2026-10-26: hodlinator: 'ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd'", "pin": null, "from_schema": 2 }, { "reviewer": "hodlinator", "association": "MEMBER", "type": "suggestion", "kind": "style", "harm": "", "request": "Compute the incomplete push script at compile time using hex literal", "question": "", "text": "Compute the incomplete push script at compile time using hex literal", "clears_with": "answer", "blocking": false, "status": "open", "status_note": "", "cleared": false, "author_replied": false, "others_replied": false, "fix_pushed": false, "replies": [], "evidence": "2026-10-26: 'nit: Could compute at compile time'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4376274486", "id": "rc:4376274486", "at": "2026-10-26", "status_at": null, "status_by": null, "resolution_evidence": "", "pin": null, "from_schema": 2 }, { "reviewer": "optout21", "association": "CONTRIBUTOR", "type": "suggestion", "kind": "scope", "harm": "", "request": "Adjust the 0x04/0x05 error codepath in DecompressScript or soften the commit message claim that the result is independent of prior contents", "question": "", "text": "Adjust the 0x04/0x05 error codepath in DecompressScript or soften the commit message claim that the result is independent of prior contents", "clears_with": "answer", "blocking": false, "status": "accepted", "status_note": "dropped in rc:4389807813 upon realizing #36280 addresses it, though c:6444909520 noted answers are still appreciated", "cleared": true, "author_replied": false, "others_replied": false, "fix_pushed": false, "replies": [], "evidence": "2026-10-27: 'Either adjust this codepath as well (reset it in case of error), or soften the claim.'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4389555092", "id": "rc:4389555092", "at": "2026-10-27", "status_at": "2026-10-27", "status_by": "optout21", "resolution_evidence": "2026-10-27: optout21: 'I've just realized that #36280 addresses exactly this, so I think it's fine as it is in this PR.'", "pin": null, "from_schema": 2 }, { "reviewer": "optout21", "association": "CONTRIBUTOR", "type": "question", "kind": "approach", "harm": "", "request": "", "question": "Whether the script output variable could be cleared at the beginning of DecompressScript", "text": "Whether the script output variable could be cleared at the beginning of DecompressScript", "clears_with": "answer", "blocking": false, "status": "open", "status_note": "unanswered; optout21 noted in c:6444909520 that answers to comments would still be appreciated", "cleared": false, "author_replied": false, "others_replied": false, "fix_pushed": false, "replies": [], "evidence": "2026-10-27: 'Would it be possible to clear the `script` output variable at the beginning of this method? That would ensure the claim (independence of previous value).'", "url": "https://github.com/bitcoin/bitcoin/pull/36386#discussion_r4389749344", "id": "rc:4389749344", "at": "2026-10-27", "status_at": null, "status_by": null, "resolution_evidence": "", "pin": null, "from_schema": 2 } ], "support": [ { "reviewer": "maflcko", "reason": "lgtm either way", "substantive": false, "verdict": "", "id": "c:5906809717", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-5906809717", "at": "2026-09-30", "association": "MEMBER", "evidence": "none", "areas": [] }, { "reviewer": "jcastros", "reason": "built test_bitcoin, ran compress_tests on both commits, and verified reverting the change causes compress_oversized_script to fail", "substantive": true, "verdict": "Tested ACK", "id": "c:5997586155", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-5997586155", "at": "2026-10-05", "association": "CONTRIBUTOR", "evidence": "tested", "areas": [] }, { "reviewer": "hodlinator", "reason": "Concept ACK f313faff443e5cdbd858a54c6bb939799d7ce714", "substantive": false, "verdict": "Concept ACK", "id": "r:5515914011", "url": "https://github.com/bitcoin/bitcoin/pull/36386#pullrequestreview-5515914011", "at": "2026-10-14", "association": "MEMBER", "evidence": "none", "areas": [] }, { "reviewer": "fametrano", "reason": "decoded 1307 compressed scripts into fresh and reused targets against an independent library and verified all raw and oversized decodes match", "substantive": true, "verdict": "Tested ACK", "id": "c:6396973053", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-6396973053", "at": "2026-10-25", "association": "NONE", "evidence": "tested", "areas": [] }, { "reviewer": "hodlinator", "reason": "ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd", "substantive": false, "verdict": "ACK", "id": "r:5650692444", "url": "https://github.com/bitcoin/bitcoin/pull/36386#pullrequestreview-5650692444", "at": "2026-10-26", "association": "MEMBER", "evidence": "none", "areas": [] }, { "reviewer": "maflcko", "reason": "review ACK 426f29c3f1639e4c97be63cdf4c2e76bb86b39dd", "substantive": false, "verdict": "ACK", "id": "c:6440879122", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-6440879122", "at": "2026-10-27", "association": "MEMBER", "evidence": "none", "areas": [] }, { "reviewer": "optout21", "reason": "This change is a net improvement, independent of #36280", "substantive": true, "verdict": "ACK", "id": "c:6444909520", "url": "https://github.com/bitcoin/bitcoin/pull/36386#issuecomment-6444909520", "at": "2026-10-27", "association": "CONTRIBUTOR", "evidence": "read", "areas": [] } ], "participants": [ { "login": "maflcko", "stance": "support", "note": "ACK; previously suggested dropping test or clarifying destination reuse comment", "association": "MEMBER", "comments": 2, "first": "2026-09-30", "last": "2026-10-27" }, { "login": "jcastros", "stance": "support", "note": "Tested ACK; verified compress_tests pass and fail when reverting fix", "association": "CONTRIBUTOR", "comments": 1, "first": "2026-10-05", "last": "2026-10-05" }, { "login": "hodlinator", "stance": "support", "note": "ACK; suggested compile-time hex literal nit after earlier suggestions were addressed or dropped", "association": "MEMBER", "comments": 6, "first": "2026-10-14", "last": "2026-10-26" }, { "login": "fametrano", "stance": "support", "note": "Tested ACK; tested differential decoding of 1307 compressed scripts across fresh and reused targets", "association": "NONE", "comments": 1, "first": "2026-10-25", "last": "2026-10-25" }, { "login": "optout21", "stance": "support", "note": "ACK; asked whether script output variable could be cleared at the beginning of DecompressScript", "association": "CONTRIBUTOR", "comments": 5, "first": "2026-10-27", "last": "2026-10-27" } ], "derivation": "substantive support, no open objection (jcastros, fametrano, optout21)", "model_state": null, "corrections": [], "notes": "Added ACKs from maflcko and optout21. Recorded optout21's review comments regarding destination independence in DecompressScript, with the question on clearing script open and the codepath adjustment suggestion dropped." }, "dependencies": { "depends_on": [], "enables": [] }, "categories": [ { "name": "tools", "member": false, "evidence": "Matches keyword 'script' in the context of Bitcoin CScript, but touches core serialization in `src/compressor.h` rather than command-line tools or contrib scripts.", "band": "Unranked", "reason_tag": "bug fix", "score": 0.0, "factors": { "bug_severity": 1, "leverage": 0, "performance": 0, "security_stability": 1, "user_value": 0 }, "rationale": "Does not touch tools or developer scripts. The change fixes script decompression logic in `src/compressor.h`." } ], "confidence": "high", "uncertainties": [], "needs": [] }, "cost_usd": 0.0, "source": { "record": "2026-10-28T01:24:45+00:00", "code": "2026-10-17T01:21:17+00:00", "judgments": 1 } }