{ "number": 36366, "repo": "bitcoin/bitcoin", "url": "https://github.com/bitcoin/bitcoin/pull/36366", "title": "net: limit relative ban times to uint32", "author": "Bruce039", "author_association": "CONTRIBUTOR", "created_at": "2026-09-28T14:44:31Z", "updated_at": "2026-10-21T21:04:32Z", "description_hash": "da84085b553fc562", "age_days": 34, "draft": false, "labels": [ "RPC/REST/ZMQ" ], "milestone": null, "base": "master", "head_sha": "514ff32e2f2024555bb9f157a6e16e311af9fd9f", "head_ref": "fix-setban-bantime-overflow", "head_repo": "Bruce039/bitcoin", "head_history": [ { "t": "2026-09-28T16:45:45Z", "sha": "fcb3446ccf489784f7b1018294af138ae1a07c2e" }, { "t": "2026-09-29T07:31:24Z", "sha": "d49c1c9ab3e139158d76141b71943ff79903e87a" }, { "t": "2026-10-02T15:01:19Z", "sha": "514ff32e2f2024555bb9f157a6e16e311af9fd9f" } ], "additions": 31, "deletions": 1, "changed_files": 3, "commit_count": 1, "size_bucket": "S", "mergeable_state": "clean", "bot": { "drahtbot": { "present": true, "reviews": { "stale_ack": [ { "login": "maflcko", "url": "https://github.com/bitcoin/bitcoin/pull/36366#issuecomment-5886145451" } ] }, "conflicts": [] } }, "acks_parsed": {}, "acks_tally": { "ack": 0, "stale_ack": 0, "concept_ack": 0, "approach_ack": 0, "nack": 0, "concept_nack": 0, "approach_nack": 0 }, "reviews": { "approved": 0, "changes_requested": 0, "distinct_reviewers": [ "maflcko", "willcl-ark" ] }, "signals": { "needs_rebase": false, "ci_failed": false, "mergeable_state": "clean", "last_author_activity": "2026-10-02T15:01:36Z", "last_reviewer_activity": "2026-10-02T09:26:44Z", "last_reviewer": "willcl-ark", "author_silent_days": 30, "waiting_on_author_days": 0, "days_since_update": 11 }, "refs": { "mentioned": [], "depends_on": [], "fixes": [], "linked_issues": [], "references": [], "conflicts": [] }, "stack": { "shares_commits_with": [], "based_on": [], "base_for": [] }, "review_paths": [ "src/init.cpp", "src/rpc/net.cpp" ], "body": "`BanMan::Ban` computes the ban end as `GetTime() + bantime` (banman.cpp:140). `setban` and `-bantime` both accept any int64, so a relative bantime close to `INT64_MAX`:\n\n```\nsetban 1.2.3.5 add 9223372036854775807\n```\n\nreturns success, but the sum overflows. UBSan reports:\n\n```\nsrc/banman.cpp:140:73: runtime error: signed integer overflow: 1790412558 + 9223372036854775807 cannot be represented in type 'int64_t'\n```\n\nWithout UBSan the result wraps negative, the ban is treated as already expired, and it is silently dropped. With `-bantime=9223372036854775807` the same happens to every `setban add` that uses the default duration.\n\nThis limits relative ban times to uint32 (about 136 years):\n\n- `setban` rejects a relative bantime above `UINT32_MAX` with \"Error: bantime is too large\"\n- `-bantime` is parsed as `uint32_t`, so larger values saturate at `UINT32_MAX`\n\nAbsolute timestamps are unchanged.\n\nThe added cases in `rpc_setban.py` check that `UINT32_MAX + 1` and `INT64_MAX` are rejected, that `UINT32_MAX` is accepted, and that with `-bantime=INT64_MAX` a default-duration ban is listed with a duration of `UINT32_MAX`. Both parts fail on master and pass with the change. `p2p_disconnect_ban.py` still passes.\n\nAI tools were used to help find this issue and to prepare the patch and test.", "commits": [ { "sha": "514ff32e2f2024555bb9f157a6e16e311af9fd9f", "date": "2026-10-02T15:00:00Z", "message": "net: limit relative ban times to uint32\n\nBanMan::Ban computes the ban end as GetTime() + bantime. Both setban and\n-bantime accept any int64, so a relative bantime close to INT64_MAX\noverflows there (UBSan: signed integer overflow in banman.cpp). In\npractice the result wraps negative, the ban is treated as expired, and\nit is silently dropped.\n\nLimit relative ban times to uint32 (about 136 years):\n- setban rejects a relative bantime above UINT32_MAX\n- -bantime is capped at UINT32_MAX. It is still read as int64, so a\n larger value in settings.json does not make startup fail." } ], "timeline": [ { "t": "2026-09-28T15:08:28Z", "kind": "comment", "who": "maflcko", "assoc": "MEMBER", "text": "I am not sure about starting/trying to support durations that C++ itself doesn't even support (https://en.cppreference.com/cpp/chrono/duration)\n\nI think it would be fine to reject args that are too large. Though, argparsing doesn't really do any verification and I am sure you can find an int overflow for basically every single arg. Also, `SaturatingAdd` doesn't work for chrono types ...", "id": "c:5872774469", "url": "https://github.com/bitcoin/bitcoin/pull/36366#issuecomment-5872774469", "hash": "c470afb118b141d5", "edited": null }, { "t": "2026-09-28T16:45:45Z", "kind": "force_push", "who": "Bruce039", "commit": "fcb3446ccf489784f7b1018294af138ae1a07c2e", "id": "push:fcb3446ccf489784f7b1018294af138ae1a07c2e" }, { "t": "2026-09-28T17:06:40Z", "kind": "comment", "who": "Bruce039", "assoc": "CONTRIBUTOR", "text": "Makes sense, switched to rejecting it: setban now fails with \"Error: bantime is too large\" when a relative bantime wouldn't fit once added to the current time, next to the existing check for absolute timestamps in the past. The SaturatingAdd in BanMan::Ban is gone and -bantime is left as is.", "id": "c:5874821692", "url": "https://github.com/bitcoin/bitcoin/pull/36366#issuecomment-5874821692", "hash": "08b9805fdce8b924", "edited": null }, { "t": "2026-09-29T06:32:06Z", "kind": "review_comment", "who": "maflcko", "assoc": "MEMBER", "path": "src/rpc/net.cpp", "commit": "fcb3446ccf489784f7b1018294af138ae1a07c2e", "in_reply_to": null, "text": "```suggestion\n if (!absolute && banTime > std::numeric_limits::max()) {\n```\n\nThis should be more than enough and also avoid the weird time dependency.\n\n[quoted text omitted]\nNot sure. I'd say to either fix this fully or not at all. What about parsing it as u32?", "id": "rc:4130336905", "url": "https://github.com/bitcoin/bitcoin/pull/36366#discussion_r4130336905", "hash": "94be84f13c7960ae", "edited": null }, { "t": "2026-09-29T07:31:24Z", "kind": "force_push", "who": "Bruce039", "commit": "d49c1c9ab3e139158d76141b71943ff79903e87a", "id": "push:d49c1c9ab3e139158d76141b71943ff79903e87a" }, { "t": "2026-09-29T07:31:44Z", "kind": "review_comment", "who": "Bruce039", "assoc": "CONTRIBUTOR", "path": "src/rpc/net.cpp", "commit": "fcb3446ccf489784f7b1018294af138ae1a07c2e", "in_reply_to": 4130336905, "text": "Done, took the suggestion: `setban` now rejects a relative bantime above `UINT32_MAX`, and `-bantime` is parsed as `uint32_t` so larger values saturate there instead of overflowing later. The test covers both.", "id": "rc:4130783968", "url": "https://github.com/bitcoin/bitcoin/pull/36366#discussion_r4130783968", "hash": "936ea0883acd4d8e", "edited": "2026-09-29T07:32:54Z" }, { "t": "2026-09-29T08:01:14Z", "kind": "comment", "who": "maflcko", "assoc": "MEMBER", "text": "lgtm ACK d49c1c9ab3e139158d76141b71943ff79903e87a\n\nSeems fine to reject or clamp values larger than any meaningful use-case.", "id": "c:5886145451", "url": "https://github.com/bitcoin/bitcoin/pull/36366#issuecomment-5886145451", "hash": "6198ba2bf91ea3d2", "edited": null }, { "t": "2026-10-02T09:26:44Z", "kind": "review_comment", "who": "willcl-ark", "assoc": "MEMBER", "path": "src/init.cpp", "commit": "d49c1c9ab3e139158d76141b71943ff79903e87a", "in_reply_to": null, "text": "In d49c1c9ab3e139158d76141b71943ff79903e87a\n\nThis covers startup args correctly but I think settings.json can also have a value > uint32 which will throw during conversion.\n\nNot sure if that's common enough (or at all) to worry about though.", "id": "rc:4164461680", "url": "https://github.com/bitcoin/bitcoin/pull/36366#discussion_r4164461680", "hash": "015ce9e34fcbedaf", "edited": "2026-10-02T09:27:52Z" }, { "t": "2026-10-02T15:01:19Z", "kind": "force_push", "who": "Bruce039", "commit": "514ff32e2f2024555bb9f157a6e16e311af9fd9f", "id": "push:514ff32e2f2024555bb9f157a6e16e311af9fd9f" }, { "t": "2026-10-02T15:01:36Z", "kind": "review_comment", "who": "Bruce039", "assoc": "CONTRIBUTOR", "path": "src/init.cpp", "commit": "d49c1c9ab3e139158d76141b71943ff79903e87a", "in_reply_to": 4164461680, "text": "Good catch, thanks. A bantime above uint32 in settings.json made startup fail with \"JSON integer out of range\". `-bantime` is now read as int64 again and capped at UINT32_MAX, so it no longer matters where the value comes from. Added a settings.json case to rpc_setban.py, which fails on the previous push. (Changes prepared with AI tools.)", "id": "rc:4166957853", "url": "https://github.com/bitcoin/bitcoin/pull/36366#discussion_r4166957853", "hash": "b2fabfa1869f221d", "edited": null } ], "labels_log": [ { "t": "2026-09-28T16:46:00Z", "action": "labeled", "label": "RPC/REST/ZMQ", "who": "DrahtBot" }, { "t": "2026-10-09T13:43:29Z", "action": "labeled", "label": "CI failed", "who": "DrahtBot" }, { "t": "2026-10-09T16:07:47Z", "action": "unlabeled", "label": "CI failed", "who": "DrahtBot" } ], "state_log": [ { "t": "2026-09-28T16:45:56Z", "kind": "renamed", "who": "Bruce039", "from": "banman: avoid overflow for large relative ban times", "to": "rpc: reject setban bantime that would overflow" }, { "t": "2026-09-29T07:31:35Z", "kind": "renamed", "who": "Bruce039", "from": "rpc: reject setban bantime that would overflow", "to": "net: limit relative ban times to uint32" } ], "text_chars": 3800, "text_tokens_estimate": 950, "changed_paths": [ "src/init.cpp", "src/rpc/net.cpp", "test/functional/rpc_setban.py" ], "files": [ { "path": "src/init.cpp", "add": 1, "del": 1 }, { "path": "src/rpc/net.cpp", "add": 5, "del": 0 }, { "path": "test/functional/rpc_setban.py", "add": 25, "del": 0 } ], "test_lines": 25, "git": { "head": "514ff32e2f2024555bb9f157a6e16e311af9fd9f", "head_matches_backup": true, "base": "05bc2f53ce0cb239c17dbdd6b261bd2db7d2a940", "patch_id": "5088b93bfc05eb4c", "commits": [ { "sha": "514ff32e2f", "subject": "net: limit relative ban times to uint32", "files": 3, "add": 31, "del": 1 } ], "patch_truncated": false }, "patch_id": "5088b93bfc05eb4c", "input_hash": "1445f74399cd7b37", "extracted_at": "2026-11-02T01:09:49+00:00" }