psbt: Fix `PSBTInputSignedAndVerified` bounds `assert`
What the developer wrote
Authored by Lőrinc
psbt: Fix `PSBTInputSignedAndVerified` bounds `assert`
The previous `assert` used `>=`, allowing `input_index == psbt.inputs.size()` and out-of-bounds access in `psbt.inputs[input_index]`.
Found during review: https://github.com/bitcoin/bitcoin/pull/31650#discussion_r2685892867
What changed, and why it matters
A one-character bug fix in Bitcoin Core's PSBT (Partially Signed Bitcoin Transaction) handling. The code used the wrong comparison in a safety check, so it was possible to request an input index exactly equal to the number of inputs. That would read one element past the end of the list, which can cause a crash or undefined behavior. The fix changes the check so it correctly rejects that out-of-bounds index.
Apply the patch. Consider whether the function should return a failure status instead of asserting, since assert behavior depends on build configuration and callers may pass untrusted input indices.
Security signals we found
Out-of-bounds vector access due to incorrect bounds assertion
Use of assert for input validation (debug-only abort, not runtime error handling)
Fix discovered during peer review rather than active incident response
Evidence from the diff
PSBTInputSignedAndVerified in src/psbt.cpp previously asserted psbt.inputs.size() >= input_index, which permits input_index == psbt.inputs.size(). That leads to an out-of-bounds read on the next line (psbt.inputs[input_index]). The patch changes the assertion to input_index < psbt.inputs.size(), correctly guarding the vector access. The bug was found during code review of PR #31650, not reported as an in-the-wild exploit.
Changed components
src/psbt.cppPSBTInputSignedAndVerified functionPartiallySignedTransaction input verificationInspect captured patch +1 / −1
diff --git a/src/psbt.cpp b/src/psbt.cpp
index 9e99ca5e..9339bf7c 100644
--- a/src/psbt.cpp
+++ b/src/psbt.cpp
@@ -325,7 +325,7 @@ bool PSBTInputSigned(const PSBTInput& input)
bool PSBTInputSignedAndVerified(const PartiallySignedTransaction psbt, unsigned int input_index, const PrecomputedTransactionData* txdata)
{
CTxOut utxo;
- assert(psbt.inputs.size() >= input_index);
+ assert(input_index < psbt.inputs.size());
const PSBTInput& input = psbt.inputs[input_index];
if (input.non_witness_utxo) {
Why this scored 45/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.