Bugfix: prioritisetransaction: Do some basic sanity checking on txid

Besides giving a nicer error, this also prevents logging arbitrary data (which could have been used to exploit log readers) into debug.log

diff --git a/src/core_io.h b/src/core_io.h
index aba1928a366460255c98aa4ac91b1dbae009e79c..bc2eb1edd09955d6ca8c36e5b204ca9d1307561c 100644 (file)
--- a/src/core_io.h
+++ b/src/core_io.h
@@ -19,6 +19,7 @@ extern CScript ParseScript(std::string s);
 extern bool DecodeHexTx(CTransaction& tx, const std::string& strHexTx);
 extern bool DecodeHexBlk(CBlock&, const std::string& strHexBlk);
 extern uint256 ParseHashUV(const UniValue& v, const std::string& strName);
+extern uint256 ParseHashStr(const std::string&, const std::string& strName);
 extern std::vector<unsigned char> ParseHexUV(const UniValue& v, const std::string& strName);
 
 // core_write.cpp

diff --git a/src/core_read.cpp b/src/core_read.cpp
index 65c3a08c551ebcd7121d63fc166a1bd4019110a3..beb746ce9702510b27556b61b88929eb5a6b3db3 100644 (file)
--- a/src/core_read.cpp
+++ b/src/core_read.cpp
@@ -131,6 +131,11 @@ uint256 ParseHashUV(const UniValue& v, const string& strName)
     string strHex;
     if (v.isStr())
         strHex = v.getValStr();
+    return ParseHashStr(strHex, strName);  // Note: ParseHashStr("") throws a runtime_error
+}
+
+uint256 ParseHashStr(const std::string& strHex, const std::string& strName)
+{
     if (!IsHex(strHex)) // Note: IsHex("") is false
         throw runtime_error(strName+" must be hexadecimal string (not '"+strHex+"')");
 

diff --git a/src/rpcmining.cpp b/src/rpcmining.cpp
index 45899d3db5330f3a767e843e659d7a5b2984782a..9694ec2ea0cbdb03150931aa547dcacf59a9213e 100644 (file)
--- a/src/rpcmining.cpp
+++ b/src/rpcmining.cpp
@@ -288,8 +288,7 @@ Value prioritisetransaction(const Array& params, bool fHelp)
             + HelpExampleRpc("prioritisetransaction", "\"txid\", 0.0, 10000")
         );
 
-    uint256 hash;
-    hash.SetHex(params[0].get_str());
+    uint256 hash = ParseHashStr(params[0].get_str(), "txid");
 
     CAmount nAmount = params[2].get_int64();