Skip to content

BeamHash III: don't read past the end of the index vector (#2151) - #2152

Open
profinch wants to merge 1 commit into
BeamMW:masterfrom
profinch:fix/beamhash3-minimal-oob
Open

profinch wants to merge 1 commit into
BeamMW:masterfrom
profinch:fix/beamhash3-minimal-oob

Conversation

@profinch

@profinch profinch commented Oct 6, 2026

Copy link
Copy Markdown

Fixes #2151.

GetMinimalFromIndices started its loop at i = sol.size() and so read sol[32], one element past the end. The loop now starts at sol.size() - 1.

The output is unchanged; the stray element was shifted out of the 800-bit stream anyway.

Tested

  • Old vs fixed function on 100,000 random 32-index sets: byte-identical output, and GetIndicesFromMinimal round-trips every fixed result. Under _LIBCPP_HARDENING_MODE_DEBUG the old version aborts at once (vector[] index out of bounds); the fixed one runs clean under ASan/UBSan too.
  • The reference solver (OptimisedSolve) built with this change, input = 32 zero bytes, nonce = 0: the same solution as before (one solution, 5 min on an M5 Pro).
  • equihash_test, stratum_test pass (macOS arm64, RelWithDebInfo).

GetMinimalFromIndices started its loop at sol.size() and read sol[32].
The value was shifted out of the 800-bit stream, so the output is
unchanged, but the read was out of bounds (libc++ hardening aborts on it).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BeamHash III: GetMinimalFromIndices reads one element past the end of the index vector

1 participant