{
 "number": 35281,
 "repo": "bitcoin/bitcoin",
 "url": "https://github.com/bitcoin/bitcoin/pull/35281",
 "title": "univalue: respect token end pointer",
 "author": "ferminquant",
 "author_association": "FIRST_TIME_CONTRIBUTOR",
 "created_at": "2026-05-13T14:25:26Z",
 "updated_at": "2026-09-09T16:29:24Z",
 "age_days": 127,
 "draft": false,
 "labels": [
  "RPC/REST/ZMQ",
  "Needs rebase"
 ],
 "milestone": null,
 "base": "master",
 "head_sha": "b9a54af80b6ed64fb10849c6f1f29f9b766cbfae",
 "head_ref": "fix-univalue-token-bounds",
 "head_repo": "ferminquant/bitcoin",
 "head_history": [
  {
   "t": "2026-05-13T14:42:00Z",
   "sha": "50c6a17a026dcf36858b3afa99f260b994e15f4f"
  },
  {
   "t": "2026-05-13T15:29:08Z",
   "sha": "e9a2bbe3efd496e73428d47b516f5020d363da0d"
  },
  {
   "t": "2026-05-14T01:14:31Z",
   "sha": "db49f974fef8e171ef4e975548d9b7b703daf8d8"
  },
  {
   "t": "2026-08-06T21:36:05Z",
   "sha": "7f633b3beaa7778d0e2dcc87b9cd2baf5490c939"
  },
  {
   "t": "2026-08-07T15:08:13Z",
   "sha": "d107f950e89389ef81b5f9b8d0e621e35c8800ef"
  },
  {
   "t": "2026-08-07T15:43:58Z",
   "sha": "e40cccfda5a72eee04fc72d753104250ef1d847e"
  },
  {
   "t": "2026-08-07T16:27:00Z",
   "sha": "b9a54af80b6ed64fb10849c6f1f29f9b766cbfae"
  }
 ],
 "additions": 34,
 "deletions": 31,
 "changed_files": 10,
 "commit_count": 1,
 "size_bucket": "S",
 "mergeable_state": "dirty",
 "bot": {
  "drahtbot": {
   "present": true,
   "reviews": {
    "concept_ack": [
     {
      "login": "sedited",
      "url": "https://github.com/bitcoin/bitcoin/pull/35281#pullrequestreview-4635181464"
     }
    ],
    "stale_ack": [
     {
      "login": "carloantinarella",
      "url": "https://github.com/bitcoin/bitcoin/pull/35281#issuecomment-4663531919"
     }
    ]
   },
   "conflicts": [
    {
     "number": 36116,
     "title": "iwyu: Fix warnings in `src/rpc` and treat them as errors",
     "author": "hebasto"
    }
   ]
  }
 },
 "acks_parsed": {
  "sedited": {
   "kind": "concept_ack",
   "hash": null,
   "t": "2026-07-06T11:31:57Z",
   "stale": false
  }
 },
 "acks_tally": {
  "ack": 0,
  "stale_ack": 0,
  "concept_ack": 1,
  "approach_ack": 0,
  "nack": 0,
  "concept_nack": 0,
  "approach_nack": 0
 },
 "reviews": {
  "approved": 0,
  "changes_requested": 0,
  "distinct_reviewers": [
   "carloantinarella",
   "maflcko",
   "sedited"
  ]
 },
 "signals": {
  "needs_rebase": true,
  "ci_failed": false,
  "mergeable_state": "dirty",
  "last_author_activity": "2026-08-07T16:27:00Z",
  "last_reviewer_activity": "2026-08-07T16:20:41Z",
  "last_reviewer": "maflcko",
  "author_silent_days": 40,
  "waiting_on_author_days": 0,
  "days_since_update": 7
 },
 "refs": {
  "mentioned": [
   28260
  ],
  "depends_on": [],
  "fixes": [
   28260
  ],
  "linked_issues": [
   {
    "number": 28260,
    "type": "issue",
    "state": "open",
    "merged": false,
    "merged_at": null,
    "title": "getJsonToken assumes underlying string is null-terminated but requires end pointer"
   }
  ],
  "references": [
   {
    "number": 28260,
    "type": "issue",
    "state": "open",
    "merged": false,
    "merged_at": null,
    "title": "getJsonToken assumes underlying string is null-terminated but requires end pointer"
   }
  ],
  "conflicts": [
   36116
  ]
 },
 "stack": {
  "shares_commits_with": [],
  "based_on": [],
  "base_for": []
 },
 "review_paths": [
  "src/test/fuzz/parse_univalue.cpp",
  "src/univalue/lib/univalue_read.cpp",
  "src/univalue/test/unitester.cpp"
 ],
 "body": "Fixes #28260.\n\nAvoid reading past the supplied end pointer in two places:\n\n- matching JSON keywords with strncmp;\n- validating number prefixes with firstDigit[1].\n\nAlso update the UniValue unit test and parse_univalue fuzz target to exercise bounded input.",
 "commits": [
  {
   "sha": "b9a54af80b6ed64fb10849c6f1f29f9b766cbfae",
   "date": "2026-08-07T16:26:50Z",
   "message": "univalue: respect token end pointer\n\nAvoid reading past the supplied end pointer when matching JSON keywords and validating number prefixes.\n\nAlso update the UniValue test and parse_univalue fuzz target to exercise bounded input."
  }
 ],
 "timeline": [
  {
   "t": "2026-05-13T14:42:00Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "50c6a17a026dcf36858b3afa99f260b994e15f4f"
  },
  {
   "t": "2026-05-13T15:29:08Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "e9a2bbe3efd496e73428d47b516f5020d363da0d"
  },
  {
   "t": "2026-05-13T15:56:01Z",
   "kind": "review_comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "path": "src/test/fuzz/parse_univalue.cpp",
   "commit": "e9a2bbe3efd496e73428d47b516f5020d363da0d",
   "in_reply_to": null,
   "text": "why the `?`?"
  },
  {
   "t": "2026-05-14T01:14:31Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "db49f974fef8e171ef4e975548d9b7b703daf8d8"
  },
  {
   "t": "2026-05-14T01:16:22Z",
   "kind": "review_comment",
   "who": "ferminquant",
   "assoc": "NONE",
   "path": "src/test/fuzz/parse_univalue.cpp",
   "commit": "e9a2bbe3efd496e73428d47b516f5020d363da0d",
   "in_reply_to": 3235660246,
   "text": "You're right, it's not needed. I fixed it in a new commit."
  },
  {
   "t": "2026-06-08T16:58:47Z",
   "kind": "review_comment",
   "who": "carloantinarella",
   "assoc": "CONTRIBUTOR",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "28f609c7bb78c233356470b9399c35b3183563a6",
   "in_reply_to": null,
   "text": "Would it be the case to add also few tests for fractions and exp numbers?"
  },
  {
   "t": "2026-06-09T17:56:56Z",
   "kind": "review_comment",
   "who": "ferminquant",
   "assoc": "NONE",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "28f609c7bb78c233356470b9399c35b3183563a6",
   "in_reply_to": 3374976297,
   "text": "Added in commit 28f609c7bb \u2014 eight tests covering fractions, exponents, and combined, using the same size/end-pointer pattern as the existing tests in this function."
  },
  {
   "t": "2026-06-09T20:01:12Z",
   "kind": "comment",
   "who": "carloantinarella",
   "assoc": "CONTRIBUTOR",
   "text": "tACK 28f609c7bb78c233356470b9399c35b3183563a6\n\nThanks for the added tests.\nOne comment: my suggestion is to squash the two commits into a single one, as they do not seem to represent different logical steps."
  },
  {
   "t": "2026-07-06T10:58:08Z",
   "kind": "review_comment",
   "who": "sedited",
   "assoc": "MEMBER",
   "path": "src/univalue/lib/univalue_read.cpp",
   "commit": "28f609c7bb78c233356470b9399c35b3183563a6",
   "in_reply_to": null,
   "text": "I would prefer if this used the more straight forward `std::string_view raw_view{raw, end}` than doing pointer arithmetic."
  },
  {
   "t": "2026-07-06T11:22:52Z",
   "kind": "review_comment",
   "who": "sedited",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "28f609c7bb78c233356470b9399c35b3183563a6",
   "in_reply_to": null,
   "text": "Isn't this tested already in the fixture files?"
  },
  {
   "t": "2026-07-06T11:24:04Z",
   "kind": "review_comment",
   "who": "sedited",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "db49f974fef8e171ef4e975548d9b7b703daf8d8",
   "in_reply_to": null,
   "text": "Is this really worthwhile? Seems like these kind of cases are better covered in the fuzz test anyway."
  },
  {
   "t": "2026-07-06T11:24:22Z",
   "kind": "review_comment",
   "who": "sedited",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "db49f974fef8e171ef4e975548d9b7b703daf8d8",
   "in_reply_to": null,
   "text": "Isn't this covered in the test fixtures already?"
  },
  {
   "t": "2026-07-06T11:31:57Z",
   "kind": "review",
   "who": "sedited",
   "assoc": "MEMBER",
   "state": "COMMENTED",
   "commit": "28f609c7bb78c233356470b9399c35b3183563a6",
   "text": "Concept ACK\n\nI think most of these unit tests are redundant however. Also not sure we should be introducing a new utility for this. I think the only cases actually adding a bit of coverage is the leading `-01` case. Maybe that should just be covered by some more test fixture files?\n\nEDIT:\n\nIt would also be good to mention that this is fixing two separate out of bounds reads."
  },
  {
   "t": "2026-08-04T15:28:06Z",
   "kind": "comment",
   "who": "sedited",
   "assoc": "MEMBER",
   "text": "@ferminquant can you respond to the review here? It's been a month."
  },
  {
   "t": "2026-08-04T15:38:18Z",
   "kind": "review_comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "7f633b3beaa7778d0e2dcc87b9cd2baf5490c939",
   "in_reply_to": null,
   "text": "can be removed as well, given the fuzz test, and the other tests."
  },
  {
   "t": "2026-08-06T21:28:45Z",
   "kind": "comment",
   "who": "ferminquant",
   "assoc": "NONE",
   "text": "Thanks for the review. Done in commit 7f633b3beaa7778d0e2dcc87b9cd2baf5490c939:\n\n- Reduced the unit coverage to the minimal bounded-end regressions and removed the extra helper.\n- Updated the std::string_view construction.\n- Updated the PR description to mention the two independent out-of-bounds reads.\n- Squashed the two commits.\n\nThe focused UniValue test builds and passes locally."
  },
  {
   "t": "2026-08-06T21:36:05Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "7f633b3beaa7778d0e2dcc87b9cd2baf5490c939"
  },
  {
   "t": "2026-08-07T06:12:38Z",
   "kind": "review_comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "7f633b3beaa7778d0e2dcc87b9cd2baf5490c939",
   "in_reply_to": null,
   "text": "This should be a string view on a buffer, like in the fuzz test"
  },
  {
   "t": "2026-08-07T06:16:30Z",
   "kind": "review_comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "b9a54af80b6ed64fb10849c6f1f29f9b766cbfae",
   "in_reply_to": null,
   "text": "Seems fine, but this should either be a correctly-sized buffer (without null-term), or it should be moved to a fixture file."
  },
  {
   "t": "2026-08-07T15:08:13Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "d107f950e89389ef81b5f9b8d0e621e35c8800ef"
  },
  {
   "t": "2026-08-07T15:25:16Z",
   "kind": "review_comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "d107f950e89389ef81b5f9b8d0e621e35c8800ef",
   "in_reply_to": null,
   "text": "Well, this is adding back the null-byte"
  },
  {
   "t": "2026-08-07T15:36:19Z",
   "kind": "comment",
   "who": "ferminquant",
   "assoc": "NONE",
   "text": "Thanks, fixed in d107f950e8:\n\n- Kept fixture inputs as std::string_view without copying.\n- Removed no_nul_test().\n- Changed bounded_input_test() to use correctly sized, non-null-terminated buffers.\n\nThe focused UniValue test passes locally."
  },
  {
   "t": "2026-08-07T15:43:58Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "e40cccfda5a72eee04fc72d753104250ef1d847e"
  },
  {
   "t": "2026-08-07T16:20:41Z",
   "kind": "review_comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "path": "src/univalue/test/unitester.cpp",
   "commit": "e40cccfda5a72eee04fc72d753104250ef1d847e",
   "in_reply_to": null,
   "text": "Either this needs to be copied into a fresh buffer (so that truly no data follows), or the tests need to be adjusted to not have trailing whitespace."
  },
  {
   "t": "2026-08-07T16:27:00Z",
   "kind": "force_push",
   "who": "ferminquant",
   "commit": "b9a54af80b6ed64fb10849c6f1f29f9b766cbfae"
  }
 ],
 "labels_log": [
  {
   "t": "2026-05-13T14:25:29Z",
   "action": "labeled",
   "label": "RPC/REST/ZMQ",
   "who": "DrahtBot"
  },
  {
   "t": "2026-05-13T16:06:34Z",
   "action": "labeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-05-14T16:26:22Z",
   "action": "unlabeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-05-21T15:19:05Z",
   "action": "labeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-05-21T17:00:40Z",
   "action": "unlabeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-09-09T16:29:23Z",
   "action": "labeled",
   "label": "Needs rebase",
   "who": "DrahtBot"
  }
 ],
 "state_log": [],
 "text_chars": 2888,
 "text_tokens_estimate": 722,
 "changed_paths": [
  "src/test/fuzz/parse_univalue.cpp",
  "src/univalue/lib/univalue_read.cpp",
  "src/univalue/test/round1.json",
  "src/univalue/test/round2.json",
  "src/univalue/test/round3.json",
  "src/univalue/test/round4.json",
  "src/univalue/test/round5.json",
  "src/univalue/test/round6.json",
  "src/univalue/test/round7.json",
  "src/univalue/test/unitester.cpp"
 ],
 "files": [
  {
   "path": "src/test/fuzz/parse_univalue.cpp",
   "add": 3,
   "del": 2
  },
  {
   "path": "src/univalue/lib/univalue_read.cpp",
   "add": 11,
   "del": 7
  },
  {
   "path": "src/univalue/test/round1.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/round2.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/round3.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/round4.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/round5.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/round6.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/round7.json",
   "add": 1,
   "del": 1
  },
  {
   "path": "src/univalue/test/unitester.cpp",
   "add": 13,
   "del": 15
  }
 ],
 "test_lines": 5,
 "git": {
  "head": "b9a54af80b6ed64fb10849c6f1f29f9b766cbfae",
  "head_matches_backup": true,
  "base": "10ca73c02cbff59f2134c0c7da3b8d0a7e727475",
  "commits": [
   {
    "sha": "b9a54af80b",
    "subject": "univalue: respect token end pointer",
    "files": 10,
    "add": 34,
    "del": 31
   }
  ],
  "patch_truncated": false
 },
 "input_hash": "fd95b92c86b0965f",
 "extracted_at": "2026-09-17T16:15:31+00:00"
}