Repository: bitcoindevkit/bdk-cli (language: rust)

Issue:
RUSTSEC-2022-0046: Out-of-bounds read when opening multiple column families with TTL

> Out-of-bounds read when opening multiple column families with TTL

| Details             |                                                |
| ------------------- | ---------------------------------------------- |
| Package             | `rocksdb`                      |
| Version             | `0.14.0`                   |
| URL                 | [https://github.com/rust-rocksdb/rust-rocksdb/pull/616](https://github.com/rust-rocksdb/rust-rocksdb/pull/616) |
| Date                | 2022-05-11                         |
| Patched versions    | `>=0.19.0`                  |

Affected versions of this crate called the RocksDB C API
`rocksdb_open_column_families_with_ttl()` with a pointer to a single integer
TTL value, but one TTL value for each column family is expected.

This is only relevant when using
`rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl()` with multiple
column families.

This bug has been fixed in v0.19.0.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2022-0046.html) for additional details.



Discussion / hints:
Well need to update rocksdb in `bdk` first, then we can fix this in `bdk-cli`. 

Fix patch:
diff --git a/.github/workflows/code_coverage.yml b/.github/workflows/code_coverage.yml
index c9e378e..135203f 100644
--- a/.github/workflows/code_coverage.yml
+++ b/.github/workflows/code_coverage.yml
@@ -38,8 +38,9 @@ jobs:
       - name: Test Esplora-reqwest
         run: cargo test --features esplora-reqwest
 
-      - name: Test Compact Filters
-        run: cargo test --features compact_filters
+      # Temporarily disable compact filters
+      #- name: Test Compact Filters
+      #  run: cargo test --features compact_filters
 
       - name: Test RPC
         run: cargo test --features rpc
diff --git a/.github/workflows/cont_integration.yml b/.github/workflows/cont_integration.yml
index 686e7f7..0984f74 100644
--- a/.github/workflows/cont_integration.yml
+++ b/.github/workflows/cont_integration.yml
@@ -20,7 +20,7 @@ jobs:
           - esplora-ureq,sqlite-db
           - esplora-reqwest,sqlite-db
           - compiler,sqlite-db
-          - compact_filters,sqlite-db
+          #- compact_filters,sqlite-db # Compact Filters temporarily disabled
           - rpc,sqlite-db
           - reserves,electrum,sqlite-db
           - electrum,verify,sqlite-db
diff --git a/Cargo.lock b/Cargo.lock
index 9e516b7..aa6912d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -99,7 +99,6 @@ dependencies = [
  "bitcoin",
  "bitcoinconsensus",
  "bitcoincore-rpc",
- "cc",
  "electrum-client",
  "esplora-client",
  "futures",
@@ -108,12 +107,10 @@ dependencies = [
  "log",
  "miniscript",
  "rand 0.8.5",
- "rocksdb",
  "rusqlite",
  "serde",
  "serde_json",
  "sled",
- "socks",
  "tokio",
 ]
 
@@ -174,25 +171,6 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d86b93f97252c47b41663388e6d155714a9d0c398b99f1005cbc5f978b29f445"
 
-[[package]]
-name = "bindgen"
-version = "0.59.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bd2a9a458e8f4304c52c43ebb0cfbd520289f8379a52e329a38afda99bf8eb8"
-dependencies = [
- "bitflags",
- "cexpr",
- "clang-sys",
- "lazy_static",
- "lazycell",
- "peeking_take_while",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex",
-]
-
 [[package]]
 name = "bip39"
 version = "1.0.1"
@@ -335,18 +313,6 @@ name = "cc"
 version = "1.0.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "76a284da2e6fe2092f2353e51713435363112dfd60030e22add80be333fb928f"
-dependencies = [
- "jobserver",
-]
-
-[[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom",
-]
 
 [[package]]
 name = "cfg-if"
@@ -360,17 +326,6 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fff857943da45f546682664a79488be82e69e43c1a7a2307679ab9afb3a66d2e"
 
-[[package]]
-name = "clang-sys"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa2e27ae6ab525c3d369ded447057bca5438d86dc3a68f6faafb8269ba82ebf3"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
 [[package]]
 name = "clap"
 version = "3.2.23"
@@ -849,12 +804,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "glob"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
-
 [[package]]
 name = "h2"
 version = "0.3.15"
@@ -1035,15 +984,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
 
-[[package]]
-name = "jobserver"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "068b1ee6743e4d11fb9c6a1e6064b3693a1b600e7f5f5988047d98b3dc9fb90b"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "js-sys"
 version = "0.3.56"
@@ -1071,40 +1011,12 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
 [[package]]
 name = "libc"
 version = "0.2.137"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
 
-[[package]]
-name = "libloading"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "librocksdb-sys"
-version = "6.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c309a9d2470844aceb9a4a098cf5286154d20596868b75a6b36357d2bb9ca25d"
-dependencies = [
- "bindgen",
- "cc",
- "glob",
- "libc",
-]
-
 [[package]]
 name = "libsqlite3-sys"
 version = "0.24.2"
@@ -1167,12 +1079,6 @@ version = "0.3.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
 
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
 [[package]]
 name = "miniscript"
 version = "8.0.0"
@@ -1259,16 +1165,6 @@ dependencies = [
  "pin-utils",
 ]
 
-[[package]]
-name = "nom"
-version = "7.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
 [[package]]
 name = "num_cpus"
 version = "1.14.0"
@@ -1361,12 +1257,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
-
 [[package]]
 name = "percent-encoding"
 version = "2.2.0"
@@ -1728,16 +1618,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "rocksdb"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61aa17a99a2413cd71c1106691bf59dad7de0cd5099127f90e9d99c429c40d4a"
-dependencies = [
- "libc",
- "librocksdb-sys",
-]
-
 [[package]]
 name = "rusqlite"
 version = "0.27.0"
@@ -1753,12 +1633,6 @@ dependencies = [
  "smallvec 1.10.0",
 ]
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc_version"
 version = "0.2.3"
@@ -1994,12 +1868,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae1a47186c03a32177042e55dbc5fd5aee900b8e0069a8d70fba96a9375cd012"
 
-[[package]]
-name = "shlex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
-
 [[package]]
 name = "slab"
 version = "0.4.7"
diff --git a/Cargo.toml b/Cargo.toml
index 4e4c0eb..56dfdb5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -57,12 +57,15 @@ sqlite-db = ["bdk/sqlite"]
 # Available blockchain client options
 rpc = ["bdk/rpc"]
 electrum = ["bdk/electrum"]
-compact_filters = ["bdk/compact_filters"]
 esplora = []
 esplora-ureq = ["esplora", "bdk/use-esplora-ureq"]
 async-interface = ["bdk/async-interface"]
 esplora-reqwest = ["esplora", "bdk/use-esplora-reqwest", "bdk/reqwest-default-tls", "async-interface"]
 
+# Compact Filters are temporarily diabled to avoid rockdb vulnerability.
+# Ref: https://github.com/bitcoindevkit/bdk-cli/issues/112
+#compact_filters = ["bdk/compact_filters"]
+
 # Use this to consensus verify transactions at sync time
 verify = ["bdk/verify"]
 


Test patch: