fix: bound DYNBITSET allocation against remaining stream size

src/Makefile.test.include

@@ -181,6 +181,7 @@ BITCOIN_TESTS =\
   test/script_tests.cpp \
   test/scriptnum_tests.cpp \
   test/serfloat_tests.cpp \
+  test/serialize_bitset_tests.cpp \
   test/serialize_tests.cpp \
   test/settings_tests.cpp \
   test/sighash_tests.cpp \

src/serialize.h

@@ -435,12 +435,31 @@ void WriteFixedBitSet(Stream& s, const std::vector<bool>& vec, size_t size)
     s.write(AsBytes(Span{vBytes}));
 }
 
-template<typename Stream>
+/** A stream that can report how many bytes are still available to read.
+ *
+ * size() must mean bytes *remaining*, not the total the stream ever held. ReadFixedBitSet
+ * relies on that to bound a wire-declared bit count before allocating, so a stream whose
+ * size() means anything else would silently weaken the bound rather than fail to compile.
+ */
+template<typename S>
+concept SizedStream = requires(const S& s) { { s.size() } -> std::convertible_to<size_t>; };
+
+template<SizedStream Stream>
 void ReadFixedBitSet(Stream& s, std::vector<bool>& vec, size_t size)
 {
+    const size_t nbytes = (size + 7) / 8;
+    // Bound the wire-declared length against the bytes actually left in the stream before
+    // allocating anything. Otherwise a handful of bytes declaring millions of bits forces a
+    // multi-megabyte resize and zero-fill that is only abandoned when the short read throws.
+    // A well-formed message always carries exactly the required bytes, so this rejects only
+    // claims that could never have been satisfied.
+    if (nbytes > s.size()) {
+        throw std::ios_base::failure("ReadFixedBitSet(): declared size exceeds remaining bytes");
+    }
+
     vec.resize(size);
 
-    std::vector<uint8_t> vBytes((size + 7) / 8);
+    std::vector<uint8_t> vBytes(nbytes);
     s.read(AsWritableBytes(Span{vBytes}));
     for (size_t p = 0; p < size; p++)
         vec[p] = (vBytes[p / 8] & (1 << (p % 8))) != 0;

src/test/serialize_bitset_tests.cpp

@@ -0,0 +1,103 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <llmq/commitment.h>
+#include <llmq/params.h>
+#include <serialize.h>
+#include <streams.h>
+#include <test/util/setup_common.h>
+#include <uint256.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <ios>
+#include <string>
+#include <vector>
+
+BOOST_FIXTURE_TEST_SUITE(serialize_bitset_tests, BasicTestingSetup)
+
+namespace {
+//! The bound must reject before allocating, so a short read after the fact is not good enough.
+bool RejectedBeforeAllocating(const std::string& what)
+{
+    return what.find("exceeds remaining") != std::string::npos ||
+           what.find("ReadFixedBitSet") != std::string::npos;
+}
+} // namespace
+
+/**
+ * DYNBITSET must not allocate from an attacker-declared CompactSize when the remaining stream
+ * is far too small to hold the claimed bit payload. A handful of bytes claiming ~1e6 bits is
+ * the amplification primitive: ReadCompactSize permits up to 33,554,432, which would resize a
+ * std::vector<bool> to ~4 MiB and allocate another ~4 MiB byte buffer before the short read
+ * throws. The claim below is deliberately modest so the pre-fix path also stays safe on CI.
+ */
+BOOST_AUTO_TEST_CASE(dynbitset_rejects_oversized_declared_length)
+{
+    constexpr uint64_t kClaimedBits = 1'000'000;
+
+    CDataStream s(SER_NETWORK, PROTOCOL_VERSION);
+    WriteCompactSize(s, kClaimedBits);
+    // No bit payload follows, so the remaining size is zero.
+
+    std::vector<bool> bits;
+    std::string what;
+    bool threw = false;
+    try {
+        s >> DYNBITSET(bits);
+    } catch (const std::ios_base::failure& e) {
+        threw = true;
+        what = e.what();
+    }
+    BOOST_CHECK_MESSAGE(threw, "DYNBITSET must reject a declared length that exceeds remaining bytes");
+    BOOST_CHECK_NE(bits.size(), kClaimedBits);
+    BOOST_CHECK_MESSAGE(RejectedBeforeAllocating(what), "Expected a pre-allocation rejection, got: " + what);
+}
+
+/** A legitimately sized DYNBITSET (LLMQ max 400) must still round-trip unchanged. */
+BOOST_AUTO_TEST_CASE(dynbitset_accepts_legitimate_llmq_size)
+{
+    constexpr size_t kSize = Consensus::MAX_LLMQ_SIZE;
+    std::vector<bool> original(kSize, false);
+    for (size_t i = 0; i < kSize; i += 3) {
+        original[i] = true;
+    }
+
+    CDataStream s(SER_NETWORK, PROTOCOL_VERSION);
+    s << DYNBITSET(original);
+
+    std::vector<bool> decoded;
+    s >> DYNBITSET(decoded);
+    BOOST_CHECK(decoded == original);
+}
+
+/**
+ * The same primitive is reachable from an unauthenticated QFCOMMITMENT via CFinalCommitment's
+ * signers bitset, so cover the real message type too.
+ */
+BOOST_AUTO_TEST_CASE(qfinalcommitment_rejects_oversized_signers_bitset)
+{
+    CDataStream s(SER_NETWORK, PROTOCOL_VERSION);
+    // nVersion (u16) | llmqType (u8) | quorumHash (32) | signers DYNBITSET | ...
+    s << static_cast<uint16_t>(llmq::CFinalCommitment::BASIC_BLS_NON_INDEXED_QUORUM_VERSION);
+    s << Consensus::LLMQType::LLMQ_400_85;
+    s << uint256::ONE;
+    WriteCompactSize(s, 1'000'000);
+
+    llmq::CFinalCommitment qc;
+    std::string what;
+    bool threw = false;
+    try {
+        s >> qc;
+    } catch (const std::ios_base::failure& e) {
+        threw = true;
+        what = e.what();
+    }
+    BOOST_CHECK(threw);
+    BOOST_CHECK_NE(qc.signers.size(), 1'000'000u);
+    BOOST_CHECK_MESSAGE(RejectedBeforeAllocating(what),
+                        "Expected a pre-allocation rejection for CFinalCommitment, got: " + what);
+}
+
+BOOST_AUTO_TEST_SUITE_END()