#36717 init: reject -port=65535 when the onion port has to be derived from it

ReviewabilityReviewsAgreementSize
#36717 Snan0M init: reject -port=65535 when the onion port has to be derived from itReady0Crickets14 + 11 tests
  • Prevent integer overflow on startup when deriving the default Tor onion service port from -port=65535
  • Stop the node from unintentionally binding the onion service to an arbitrary ephemeral port
  • Ready for review
  • No review verdicts recorded
  • No substantive discussion or review comments yet
  • No support or objections recorded
  • 14 lines added or modified outside tests
  • 11 lines added or modified in tests
  • 4 lines removed in total
  • 2 files, 1 commits
Utilities (logging, arguments, libraries)#26 of 59
P3 · bug fix
  • P3 because it fixes an integer overflow bug in startup argument validation
  • Prevents unintended binding to arbitrary OS-assigned ports in an edge case configuration
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Rejects node startup with an initialization error if -port=65535 and the onion service bind port must be derived from it. The node now checks that default_bind_port is below UINT16_MAX before computing the default onion port, while continuing to allow -port=65535 when an explicit onion port is specified or when listening is disabled.

Problem: Bitcoin Core derives the default Tor onion service bind port by adding 1 to -port. When -port is set to 65535, the uint16_t addition wraps to 0, causing the node to bind 127.0.0.1 on an arbitrary OS-assigned ephemeral port and point the automatic Tor onion service there.

Evidence of importance:

  • Commit message and description explain the integer overflow: 'The default onion bind uses -port + 1. With -port=65535 this wraps to 0, so the node binds 127.0.0.1 to a random port and the automatic onion service points there.'

Risk of a mistake: low (p2p). A flaw would cause node initialization to fail incorrectly on valid port configuration arguments.

Changed since the previous assessment: Diff is now available; the implementation and functional test coverage match the earlier description.

Reviewability

Ready

Nothing known that would invalidate a review now.

Agreement

Crickets

no substantive comment either way

Objections, suggestions, and questions: none recorded.

Files

11 lines under test/bench/ci.

  • src/init.cpp +14/-4
  • test/functional/feature_port.py +11/-0

Card

The short text the ranking pass compares across PRs.

Bitcoin Core calculates the default Tor onion service bind port as -port + 1. When -port is set to 65535, the uint16_t addition wraps to 0, causing the node to bind 127.0.0.1 to an arbitrary OS-assigned ephemeral port for its automatic onion service. This change fails initialization with a descriptive error when -port=65535 and an onion port needs to be derived. Explicit onion bind configurations (-bind=<addr>:<port>=onion) and disabled listening (-listen=0) continue to work.

Data

dossier JSON · extract JSON · model ledger, generated 2026-11-02T01:10, confidence high, input hash d072e0efe072c848
labels: none

Categories

Utilities (logging, arguments, libraries)

P3 · bug fix

Prevents integer overflow on startup when calculating the default Tor onion port from -port=65535. When port 65535 is used without an explicit onion port, adding 1 wraps uint16_t to 0, causing the node to unintentionally bind to an arbitrary OS-assigned ephemeral port.

Membership: Touches startup validation in src/init.cpp for node argument initialization and default port configuration.

Factors: security/stability 1, bug 1, performance 0, user value 1, leverage 0