Skip to content

fix(types): use bounds-checked access in Utxo::txout() for Foreign variant#445

Open
tnull wants to merge 1 commit intobitcoindevkit:masterfrom
tnull:2026-04-fix-utxo-txout-bounds-check
Open

fix(types): use bounds-checked access in Utxo::txout() for Foreign variant#445
tnull wants to merge 1 commit intobitcoindevkit:masterfrom
tnull:2026-04-fix-utxo-txout-bounds-check

Conversation

@tnull
Copy link
Copy Markdown
Contributor

@tnull tnull commented Apr 15, 2026

Description

Replace unchecked array indexing of prev_tx.output[outpoint.vout] with .get().expect() to provide a descriptive panic message instead of an opaque index-out-of-bounds if the outpoint vout is invalid.

Co-Authored-By: HAL 9000

Checklists

All Submissions:

Bugfixes:

  • This pull request breaks the existing API
  • I've added tests to reproduce the issue which are now passing
  • I'm linking the issue being fixed by this PR

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 15, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.46%. Comparing base (fb7681a) to head (2bd536f).
⚠️ Report is 10 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #445      +/-   ##
==========================================
+ Coverage   80.04%   80.46%   +0.42%     
==========================================
  Files          24       24              
  Lines        5336     5417      +81     
  Branches      242      242              
==========================================
+ Hits         4271     4359      +88     
+ Misses        987      980       -7     
  Partials       78       78              
Flag Coverage Δ
rust 80.46% <100.00%> (+0.42%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@luisschwab
Copy link
Copy Markdown
Member

cACK, can you fix the clippy warning?

let psbt_input = psbt::Input {
    non_witness_utxo: Some(prev_tx),
    ..Default::default()
};

…variant

Replace unchecked array indexing of `prev_tx.output[outpoint.vout]` with
`.get().expect()` to provide a descriptive panic message instead of an
opaque index-out-of-bounds if the outpoint vout is invalid.

Co-Authored-By: HAL 9000
Signed-off-by: Elias Rohrer <dev@tnull.de>
@tnull tnull force-pushed the 2026-04-fix-utxo-txout-bounds-check branch from 4c0ab73 to 2bd536f Compare April 15, 2026 14:19
@tnull
Copy link
Copy Markdown
Contributor Author

tnull commented Apr 15, 2026

cACK, can you fix the clippy warning?

let psbt_input = psbt::Input {
    non_witness_utxo: Some(prev_tx),
    ..Default::default()
};

Done.

Copy link
Copy Markdown
Member

@luisschwab luisschwab left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tACK 2bd536f

Copy link
Copy Markdown
Collaborator

@ValuedMammal ValuedMammal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose this is marginally better than before. I'm not too concerned with asserting the content of the panic message string. If anything the method should state how it panics in the documentation. Noting that it generally works when combined with add_foreign_utxo, by throwing for MissingUtxo, since we can't control how the foreign Utxo is constructed in all cases, I guess the right solution long term is to handle a missing txout using Option or Result.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

3 participants