From 3f731d090ad6d7893f818442b886460e0e769bae Mon Sep 17 00:00:00 2001
From: Thomas Kerin <me@thomaskerin.io>
Date: Tue, 8 Nov 2016 13:43:45 +0100
Subject: [PATCH] Test that parsing a transaction with superfluous witness data
 leads to an error

---
 src/transaction.js             | 13 ++++++++++++-
 test/fixtures/transaction.json |  4 ++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/transaction.js b/src/transaction.js
index da73337..90fd755 100644
--- a/src/transaction.js
+++ b/src/transaction.js
@@ -120,8 +120,13 @@ Transaction.fromBuffer = function (buffer, __noStrict) {
   }
 
   if (hasWitnesses) {
+    var isNull = true
     for (i = 0; i < vinLen; ++i) {
       tx.ins[i].witness = readVector()
+      isNull = isNull && tx.ins[i].witness.length === 0
+    }
+    if (isNull) {
+      throw new Error('Transaction has superfluous witness data')
     }
   }
 
@@ -409,6 +414,7 @@ Transaction.prototype.toBuffer = function (buffer, initialOffset) {
   writeInt32(this.version)
 
   var hasWitnesses = this._hasWitnesses()
+  var serializeWitnesses = hasWitnesses // TODO: remove this, temporary
 
   if (hasWitnesses) {
     writeUInt8(Transaction.ADVANCED_TRANSACTION_MARKER)
@@ -435,10 +441,15 @@ Transaction.prototype.toBuffer = function (buffer, initialOffset) {
     writeVarSlice(txOut.script)
   })
 
-  if (hasWitnesses) {
+  if (serializeWitnesses) {
+    var isNull = true
     this.ins.forEach(function (input) {
       writeVector(input.witness)
+      isNull = isNull && input.witness.length === 0
     })
+    if (isNull) {
+      throw new Error('Transaction has superfluous witness data')
+    }
   }
 
   writeUInt32(this.locktime)
diff --git a/test/fixtures/transaction.json b/test/fixtures/transaction.json
index a96bb36..9f40559 100644
--- a/test/fixtures/transaction.json
+++ b/test/fixtures/transaction.json
@@ -287,6 +287,10 @@
       {
         "exception": "Transaction has unexpected data",
         "hex": "0100000002f1fefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefe000000006b483045022100e661badd8d2cf1af27eb3b82e61b5d3f5d5512084591796ae31487f5b82df948022006df3c2a2cac79f68e4b179f4bbb8185a0bb3c4a2486d4405c59b2ba07a74c2101210279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798fffffffff2fefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefe0100000083483045022100be54a46a44fb7e6bf4ebf348061d0dace7ddcbb92d4147ce181cf4789c7061f0022068ccab2a89a47fc29bb5074bca99ae846ab446eecf3c3aaeb238a13838783c78012102c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee517a9147ccb85f0ab2d599bc17246c98babd5a20b1cdc7687ffffffff0250c30000000000001976a914c42e7ef92fdb603af844d064faad95db9bcdfd3d88acf04902000000000017a9147ccb85f0ab2d599bc17246c98babd5a20b1cdc768700000000ffffffff"
+      },
+      {
+        "exception": "Transaction has superfluous witness data",
+        "hex": "0100000000010113ae35a2063ba413c3a1bb9b3820c76291e40e83bd3f23c8ff83333f0c64d623000000004a00483045022100e332e8367d5fee22c205ce1bf4e01e39f1a8decb3ba20d1336770cf38b8ee72d022076b5f83b3ee15390133b7ebf526ec189eb73cc6ee0a726f70b939bc51fa18d8001ffffffff0180969800000000001976a914b1ae3ceac136e4bdb733663e7a1e2f0961198a1788ac0000000000"
       }
     ]
   },