bitcoinrb 1.12.1 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e60d83b48a9f7189cd07c75ee61749ab50a83895f86dd97c7d7fbbd568234067
-  data.tar.gz: 04e39f6f592379617273944009f78d224cf181f1877de15a285665e9b25602b3
+  metadata.gz: 360a1a8533df9b68228d18279909e7bc5f45d4d5679caa1a02cda75e0a9140d0
+  data.tar.gz: ff86fcec32b3fe1394eea043080aaedafee61e724ec689cde5efdd7b9ca5c307
 SHA512:
-  metadata.gz: 13046ad4ba44662c2689d13dec7d51bc88e2d80cccaedc0048ee7484136e5cf04600161b5b7ae99faf4e1d7081fb845b403ebc3defb9cf92e46847e500befd65
-  data.tar.gz: 12c68844e79ca382dc774d6d4d6cdad8bbd33064a315098e0a31eecb88ac1369c2bd4ff6b39da49d3d5b2eae9750beff11e5761dbbdbe6221c3ef1100cd8cde2
+  metadata.gz: 9aeb17cc9dc42ce33c4c31ed1f6424569d5c0f4f20627015c930d11e5ba2bf9c15f43cd20a666257caba689ffc0010b08b5855c13a3cf61a724c05fe8bcd383d
+  data.tar.gz: 14848d9c37a69ec5b0d2f993ce92c3cad3bdfc6275151789ff768ad5989d101f9c5545f1dc668d372f847b574fdc60d10e5f90b81b377b23ac20bfb3705b0a3a

data/bitcoinrb.gemspec

@@ -27,8 +27,8 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'bip-schnorr', '>= 0.7.0'
   spec.add_runtime_dependency 'base32', '>= 0.3.4'
   spec.add_runtime_dependency 'base64', '~> 0.2.0'
-  spec.add_runtime_dependency 'secp256k1rb', '0.1.1'
+  spec.add_runtime_dependency 'secp256k1rb', '0.8.0'
   spec.add_runtime_dependency 'logger'
-  spec.add_runtime_dependency 'merkle', '0.3.0'
+  spec.add_runtime_dependency 'merkle', '1.0.0'
   spec.add_runtime_dependency 'dnsruby', '1.73.0'
 end

data/lib/bitcoin/base58.rb

@@ -8,6 +8,10 @@ module Bitcoin
     ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
     SIZE = ALPHABET.size
 
+    # Upper bound for #decode. Decoding is quadratic in the length of the input, and the
+    # longest value Bitcoin encodes with Base58 is an extended key, at 111 characters.
+    MAX_LENGTH = 256
+
     # encode hex value to base58 string.
     def encode(hex)
       leading_zero_bytes = (hex.match(/^([0]+)/) ? $1 : '').size / 2
@@ -21,11 +25,19 @@ module Bitcoin
     end
 
     # decode base58 string to hex value.
+    # @param [String] base58_val Base58 string.
+    # @return [String] Decoded value with hex format.
+    # @raise [ArgumentError] If +base58_val+ is longer than MAX_LENGTH or holds a character
+    # which is not in the alphabet.
     def decode(base58_val)
+      if base58_val.length > MAX_LENGTH
+        raise ArgumentError, "Base58 string must not be longer than #{MAX_LENGTH} characters."
+      end
       int_val = 0
-      base58_val.reverse.split(//).each_with_index do |char,index|
-        raise ArgumentError, 'Value passed not a valid Base58 String.' if (char_index = ALPHABET.index(char)).nil?
-        int_val += char_index * (SIZE ** index)
+      base58_val.each_char do |char|
+        char_index = ALPHABET.index(char)
+        raise ArgumentError, 'Value passed not a valid Base58 String.' if char_index.nil?
+        int_val = int_val * SIZE + char_index
       end
       s = int_val.to_even_length_hex
       s = '' if s == '00'

data/lib/bitcoin/bip321_uri.rb

@@ -105,7 +105,7 @@ module Bitcoin
                      req_pop = true
                      k = 'pop'
                    end
-                   if %w[bc tb].include?(k.downcase)
+                   if %w[bc tb bcrt].include?(k.downcase)
                      raise ArgumentError, "#{k} not allowed in current network." unless Bitcoin.chain_params.bech32_hrp == k.downcase
                      query_addrs << v
                      nil
@@ -160,12 +160,9 @@ module Bitcoin
       all_params = base_params.merge other_params
       params = all_params.map do |k, v|
         "#{k}=#{CGI.escape(v).gsub('+', '%20')}"
-      end.join('&')
-      uri << "?#{params}" unless params.empty?
-      unless query_addrs.empty?
-        uri << '?' unless uri.include?('?')
-        uri << query_addrs.map {|addr| "#{Bitcoin.chain_params.bech32_hrp}=#{addr}"}.join('&')
       end
+      params += query_addrs.map {|addr| "#{Bitcoin.chain_params.bech32_hrp}=#{addr}"}
+      uri << "?#{params.join('&')}" unless params.empty?
       uri
     end
   end

data/lib/bitcoin/bip324/fs_chacha20.rb

@@ -101,7 +101,7 @@ module Bitcoin
 
       def key_stream_bytes(n_bytes)
         while key_stream.bytesize < n_bytes
-          nonce = [0, (chunk_counter / REKEY_INTERVAL)].pack("VQ<")
+          nonce = [0, (chunk_counter / rekey_interval)].pack("VQ<")
           self.key_stream << ChaCha20.block(key, nonce, block_counter)
           self.block_counter += 1
         end

data/lib/bitcoin/bip324/fs_chacha_poly1305.rb

@@ -65,6 +65,7 @@ module Bitcoin
       # @return [Array] [header, plaintext]
       def decrypt(aad, ciphertext)
         contents = crypt(aad, ciphertext, true)
+        raise Bitcoin::BIP324::Error, 'Decryption failed.' unless contents
         [contents[0], contents[1..-1]]
       end
 

data/lib/bitcoin/bip324.rb

@@ -10,7 +10,9 @@ module Bitcoin
 
     autoload :EllSwiftPubkey, 'bitcoin/bip324/ell_swift_pubkey'
     autoload :Cipher, 'bitcoin/bip324/cipher'
+    autoload :ChaCha20, 'bitcoin/bip324/fs_chacha20'
     autoload :FSChaCha20, 'bitcoin/bip324/fs_chacha20'
+    autoload :Poly1305, 'bitcoin/bip324/fs_chacha_poly1305'
     autoload :FSChaCha20Poly1305, 'bitcoin/bip324/fs_chacha_poly1305'
 
     FIELD_SIZE = 2**256 - 2**32 - 977
@@ -89,13 +91,16 @@ module Bitcoin
       ECDSA::Format::IntegerOctetString.encode(result, 32).bth
     end
 
+    # Number of cases xswiftec_inv selects between. It reads c as 3 bits, c & 1, c & 2 and c & 4.
+    CASE_COUNT = 8
+
     # Given a field element X on the curve, find (u, t) that encode them.
     # @param [String] x coordinate with hex format.
     # @return [String] ElligatorSwift public key with hex format.
     def xelligatorswift(x)
       loop do
         u = SecureRandom.random_number(1..ECDSA::Group::Secp256k1.order).to_s(16)
-        c = SecureRandom.random_number(9)
+        c = SecureRandom.random_number(CASE_COUNT)
         t = xswiftec_inv(x, u, c)
         unless t.nil?
           return (ECDSA::Format::IntegerOctetString.encode(u.hex, 32) +

data/lib/bitcoin/block.rb

@@ -28,7 +28,7 @@ module Bitcoin
       header = BlockHeader.new(
         version,
         '00' * 32,
-        Merkle::BinaryTree.new(config: Merkle::Config.bitcoin, leaves: [coinbase.txid]).compute_root.rhex,
+        Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: [coinbase.txid]).compute_root.rhex,
         time,
         bits,
         nonce
@@ -72,7 +72,7 @@ module Bitcoin
 
     # calculate merkle root from tx list.
     def calculate_merkle_root
-      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin, leaves: transactions.map(&:tx_hash))
+      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: transactions.map(&:tx_hash))
       tree.compute_root
     end
 
@@ -86,7 +86,7 @@ module Bitcoin
       witness_hashes = [COINBASE_WTXID]
       witness_hashes += (transactions[1..-1].map(&:witness_hash))
       reserved_value = transactions[0].inputs[0].script_witness.stack.map(&:bth).join
-      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin, leaves: witness_hashes)
+      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: witness_hashes)
       root_hash = tree.compute_root
       Bitcoin.double_sha256([root_hash + reserved_value].pack('H*')).bth
     end

data/lib/bitcoin/descriptor/checksum.rb

@@ -18,7 +18,9 @@ module Bitcoin
         s[-8..-1].each_char do |c|
           return false unless CHECKSUM_CHARSET.include?(c)
         end
-        symbols = descsum_expand(s[0...-9]) + s[-8..-1].each_char.map{|c|CHECKSUM_CHARSET.index(c)}
+        expanded = descsum_expand(s[0...-9])
+        return false unless expanded
+        symbols = expanded + s[-8..-1].each_char.map{|c|CHECKSUM_CHARSET.index(c)}
         descsum_polymod(symbols) == 1
       end
 
@@ -26,7 +28,9 @@ module Bitcoin
       # @param [String] s Descriptor string without checksum.
       # @return [String] Descriptor string with checksum.
       def descsum_create(s)
-        symbols = descsum_expand(s) + [0, 0, 0, 0, 0, 0, 0, 0]
+        expanded = descsum_expand(s)
+        raise ArgumentError, 'Descriptor contains a character which is not in the input charset.' unless expanded
+        symbols = expanded + [0, 0, 0, 0, 0, 0, 0, 0]
         checksum = descsum_polymod(symbols) ^ 1
         result = 8.times.map do |i|
           CHECKSUM_CHARSET[(checksum >> (5 * (7 - i))) & 31]

data/lib/bitcoin/ext_key.rb

@@ -114,14 +114,16 @@ module Bitcoin
       child_priv = ECDSA::Format::IntegerOctetString.encode(child_priv, 32)
       new_key.key = Bitcoin::Key.new(priv_key: child_priv.bth, key_type: key_type)
       new_key.chain_code = l[32..-1]
-      new_key.ver = version
+      # A depth 1 key derives its version bytes from the purpose, see #version.
+      new_key.ver = new_key.depth == 1 ? nil : version
       new_key
     end
 
     # get version bytes using serialization format
     def version
+      return ver if ver
       return ExtKey.version_from_purpose(number) if depth == 1
-      ver ? ver : Bitcoin.chain_params.extended_privkey_version
+      Bitcoin.chain_params.extended_privkey_version
     end
 
     # get key type defined by BIP-178 using version.
@@ -286,14 +288,16 @@ module Bitcoin
       p2 = Bitcoin::Key.new(pubkey: pubkey, key_type: key_type).to_point
       new_key.pubkey = (p1 + p2).to_hex
       new_key.chain_code = l[32..-1]
-      new_key.ver = version
+      # A depth 1 key derives its version bytes from the purpose, see #version.
+      new_key.ver = new_key.depth == 1 ? nil : version
       new_key
     end
 
     # get version bytes using serialization format
     def version
+      return ver if ver
       return ExtPubkey.version_from_purpose(number) if depth == 1
-      ver ? ver : Bitcoin.chain_params.extended_pubkey_version
+      Bitcoin.chain_params.extended_pubkey_version
     end
 
     # get key type defined by BIP-178 using version.

data/lib/bitcoin/key.rb

@@ -120,7 +120,7 @@ module Bitcoin
         if low_r && !sig_has_low_r?(sig)
           counter = 1
           until sig_has_low_r?(sig)
-            extra_entropy = [counter].pack('I*').bth.ljust(64, '0').htb
+            extra_entropy = [counter].pack('V').bth.ljust(64, '0').htb
             sig = secp256k1_module.sign_data(data, priv_key, extra_entropy)
             counter += 1
           end
@@ -170,7 +170,7 @@ module Bitcoin
         else
           false
         end
-      rescue Exception
+      rescue StandardError
         false
       end
     end

data/lib/bitcoin/message/base.rb

@@ -32,11 +32,17 @@ module Bitcoin
         magic = buf.read(4)
         raise ArgumentError, 'Invalid magic.' unless magic == Bitcoin.chain_params.magic_head.htb
         command = buf.read(12).delete("\x00")
+        # The length is announced by the peer, so it is checked before it is used to read.
         length = buf.read(4).unpack1('V')
+        if length > MAX_PROTOCOL_MESSAGE_LENGTH
+          raise ArgumentError, "Payload must not be longer than #{MAX_PROTOCOL_MESSAGE_LENGTH} bytes."
+        end
         checksum = buf.read(4)
+        # read returns "" for a length of 0 and nil once the buffer is exhausted.
         payload = buf.read(length)
+        raise ArgumentError, 'Payload is shorter than the announced length.' unless payload&.bytesize == length
         raise ArgumentError, 'Checksum do not match.' unless checksum == Bitcoin.double_sha256(payload)[0...4]
-        Bitcoin::Message.decode(command, payload&.bth)
+        Bitcoin::Message.decode(command, payload.bth)
       end
 
     end

data/lib/bitcoin/message/cf_parser.rb

@@ -3,12 +3,12 @@ module Bitcoin
     module CFParser
 
       def parse_from_payload(payload)
-        type, start, hash = payload.unpack('CLH*')
+        type, start, hash = payload.unpack('CVH*')
         self.new(type, start, hash)
       end
 
       def to_payload
-        [filter_type, start_height, stop_hash].pack('CLH*')
+        [filter_type, start_height, stop_hash].pack('CVH*')
       end
 
     end

data/lib/bitcoin/message/fee_filter.rb

@@ -15,11 +15,11 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        new(payload.unpack1('Q'))
+        new(payload.unpack1('Q<'))
       end
 
       def to_payload
-        [fee_rate].pack('Q')
+        [fee_rate].pack('Q<')
       end
 
     end

data/lib/bitcoin/message/filter_load.rb

@@ -22,8 +22,18 @@ module Bitcoin
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
         filter_count = Bitcoin.unpack_var_int_from_io(buf)
+        # A filterload message is received from an untrusted peer, so the limits which bound
+        # the work BloomFilter#add and #contains? perform have to be enforced here.
+        if filter_count > Bitcoin::BloomFilter::MAX_BLOOM_FILTER_SIZE
+          raise Bitcoin::Message::Error,
+                "filter size must be less than or equal to #{Bitcoin::BloomFilter::MAX_BLOOM_FILTER_SIZE}."
+        end
         filter = buf.read(filter_count).unpack('C*')
         func_count = buf.read(4).unpack1('V')
+        if func_count > Bitcoin::BloomFilter::MAX_HASH_FUNCS
+          raise Bitcoin::Message::Error,
+                "hash funcs must be less than or equal to #{Bitcoin::BloomFilter::MAX_HASH_FUNCS}."
+        end
         tweak = buf.read(4).unpack1('V')
         flag = buf.read(1).unpack1('C')
         FilterLoad.new(Bitcoin::BloomFilter.new(filter, func_count, tweak), flag)

data/lib/bitcoin/message/header_and_short_ids.rb

@@ -16,13 +16,13 @@ module Bitcoin
         @nonce = nonce
         @short_ids = short_ids
         @prefilled_txn = prefilled_txn
-        @siphash_key = Bitcoin.sha256(header.to_payload << [nonce].pack('q*'))[0...16]
+        @siphash_key = Bitcoin.sha256(header.to_payload << [nonce].pack('q<*'))[0...16]
       end
 
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
         header = Bitcoin::BlockHeader.parse_from_payload(buf.read(80))
-        nonce = buf.read(8).unpack1('q*')
+        nonce = buf.read(8).unpack1('q<*')
         short_ids_len = Bitcoin.unpack_var_int_from_io(buf)
         short_ids = short_ids_len.times.map do
            buf.read(6).reverse.bth.to_i(16)
@@ -36,9 +36,9 @@ module Bitcoin
 
       def to_payload
         p = header.to_payload
-        p << [nonce].pack('q*')
+        p << [nonce].pack('q<*')
         p << Bitcoin.pack_var_int(short_ids.size)
-        p << short_ids.map{|id|sprintf('%12x', id).htb.reverse}.join
+        p << short_ids.map{|id|sprintf('%012x', id).htb.reverse}.join
         p << Bitcoin.pack_var_int(prefilled_txn.size)
         p << prefilled_txn.map(&:to_payload).join
         p

data/lib/bitcoin/message/inventory.rb

@@ -26,7 +26,7 @@ module Bitcoin
       # parse inventory payload
       def self.parse_from_payload(payload)
         raise Error, 'invalid inventory size.' if payload.bytesize != 36
-        identifier = payload[0..4].unpack1('V')
+        identifier = payload[0..3].unpack1('V')
         hash = payload[4..-1].bth # internal byte order
         new(identifier, hash)
       end

data/lib/bitcoin/message/merkle_block.rb

@@ -28,6 +28,12 @@ module Bitcoin
         flag_count = Bitcoin.unpack_var_int_from_io(buf)
         # A sequence of bits packed eight in a byte with the least significant bit first.
         m.flags = buf.read(flag_count).bth
+        # Reject a tree an untrusted peer could use to exhaust memory or CPU in #partial_tree.
+        begin
+          Bitcoin::PartialTree.validate!(m.tx_count, m.hashes, Bitcoin.byte_to_bit(m.flags.htb))
+        rescue ArgumentError => e
+          raise Bitcoin::Message::Error, e.message
+        end
         m
       end
 

data/lib/bitcoin/message/network_addr.rb

@@ -107,7 +107,7 @@ module Bitcoin
         has_time = buf.size > 26
         addr = NetworkAddr.new(time: nil)
         addr.time = buf.read(4).unpack1('V') if has_time
-        addr.services = buf.read(8).unpack1('Q')
+        addr.services = buf.read(8).unpack1('Q<')
         addr.addr = IPAddr::new_ntoh(buf.read(16))
         addr.port = buf.read(2).unpack1('n')
         addr
@@ -153,7 +153,7 @@ module Bitcoin
         p = ''
         p << [time].pack('V') unless skip_time
         ip = addr.ipv4? ? addr.ipv4_mapped : addr
-        p << [services].pack('Q') << ip.hton << [port].pack('n')
+        p << [services].pack('Q<') << ip.hton << [port].pack('n')
       end
 
       def v2_payload
@@ -163,18 +163,22 @@ module Bitcoin
         case net
         when NETWORK_ID[:ipv4]
           p << Bitcoin.pack_var_int(4)
-          p << addr.to_i.to_s(16).htb
+          p << addr.hton
         when NETWORK_ID[:ipv6]
           p << Bitcoin.pack_var_int(16)
           p << addr.hton
         when NETWORK_ID[:tor_v2]
           p << Bitcoin.pack_var_int(10)
+          p << addr.htb
         when NETWORK_ID[:tor_v3]
           p << Bitcoin.pack_var_int(32)
+          p << addr.htb
         when NETWORK_ID[:i2p]
           p << Bitcoin.pack_var_int(32)
+          p << addr.htb
         when NETWORK_ID[:cjdns]
           p << Bitcoin.pack_var_int(16)
+          p << addr.hton
         end
         p << [port].pack('n')
         p

data/lib/bitcoin/message/ping.rb

@@ -14,11 +14,11 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        new(payload.unpack1('Q'))
+        new(payload.unpack1('Q<'))
       end
 
       def to_payload
-        nonce ? [nonce].pack('Q') : ''
+        nonce ? [nonce].pack('Q<') : ''
       end
 
       # Generate pong message as a response. Return nil if the ping has no nonce

data/lib/bitcoin/message/pong.rb

@@ -14,11 +14,11 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        new(payload.unpack1('Q'))
+        new(payload.unpack1('Q<'))
       end
 
       def to_payload
-        [nonce].pack('Q')
+        [nonce].pack('Q<')
       end
     end
 

data/lib/bitcoin/message/send_cmpct.rb

@@ -22,12 +22,12 @@ module Bitcoin
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
         mode = buf.read(1).unpack1('c')
-        version = buf.read(8).unpack1('Q')
+        version = buf.read(8).unpack1('Q<')
         new(mode, version)
       end
 
       def to_payload
-        [mode, version].pack('cQ')
+        [mode, version].pack('cQ<')
       end
 
       def high?

data/lib/bitcoin/message/version.rb

@@ -32,7 +32,7 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        version, services, timestamp, local_addr, remote_addr, nonce, rest = payload.unpack('VQQa26a26Qa*')
+        version, services, timestamp, local_addr, remote_addr, nonce, rest = payload.unpack('VQ<Q<a26a26Q<a*')
         v = new
         v.version = version
         v.services = services
@@ -50,10 +50,10 @@ module Bitcoin
 
       def to_payload
         [
-          [version, services, timestamp].pack('VQQ'),
+          [version, services, timestamp].pack('VQ<Q<'),
           local_addr.to_payload(true),
           remote_addr.to_payload(true),
-          [nonce].pack('Q'),
+          [nonce].pack('Q<'),
           pack_var_string(user_agent),
           [start_height].pack('V'),
           pack_boolean(relay)

data/lib/bitcoin/message.rb

@@ -1,8 +1,6 @@
 module Bitcoin
   module Message
 
-    class Error < StandardError; end
-
     autoload :Base, 'bitcoin/message/base'
     autoload :Inventory, 'bitcoin/message/inventory'
     autoload :InventoriesParser, 'bitcoin/message/inventories_parser'
@@ -53,6 +51,9 @@ module Bitcoin
 
     USER_AGENT = "/bitcoinrb:#{Bitcoin::VERSION}/"
 
+    # The maximum payload size a peer may announce in a message header.
+    MAX_PROTOCOL_MESSAGE_LENGTH = 4_000_000
+
     SERVICE_FLAGS = {
         none: 0,
         network: 1 << 0,  # the node is capable of serving the block chain. It is currently set by all Bitcoin Core node, and is unset by SPV clients or other peers that just want network services but don't provide them.
@@ -107,6 +108,8 @@ module Bitcoin
         Pong.parse_from_payload(payload)
       when GetHeaders::COMMAND
         GetHeaders.parse_from_payload(payload)
+      when GetBlocks::COMMAND
+        GetBlocks.parse_from_payload(payload)
       when Headers::COMMAND
         Headers.parse_from_payload(payload)
       when Block::COMMAND
@@ -125,8 +128,18 @@ module Bitcoin
         Inv.parse_from_payload(payload)
       when MerkleBlock::COMMAND
         MerkleBlock.parse_from_payload(payload)
+      when FilterLoad::COMMAND
+        FilterLoad.parse_from_payload(payload)
+      when FilterAdd::COMMAND
+        FilterAdd.parse_from_payload(payload)
+      when FilterClear::COMMAND
+        FilterClear.new
       when CmpctBlock::COMMAND
         CmpctBlock.parse_from_payload(payload)
+      when GetBlockTxn::COMMAND
+        GetBlockTxn.parse_from_payload(payload)
+      when BlockTxn::COMMAND
+        BlockTxn.parse_from_payload(payload)
       when GetData::COMMAND
         GetData.parse_from_payload(payload)
       when GetCFHeaders::COMMAND

data/lib/bitcoin/mnemonic.rb

@@ -24,7 +24,7 @@ module Bitcoin
     def to_entropy(words)
       word_master = load_words
       mnemonic = words.map do |w|
-        index = word_master.index(w.downcase)
+        index = word_master.index(normalize(w).downcase)
         raise IndexError, 'word not found in words list.' unless index
         index.to_s(2).rjust(11, '0')
       end.join
@@ -53,8 +53,8 @@ module Bitcoin
     # @return [String] seed
     def to_seed(mnemonic, passphrase: '')
       to_entropy(mnemonic)
-      OpenSSL::PKCS5.pbkdf2_hmac(mnemonic.join(' ').downcase,
-                                 'mnemonic' + passphrase, 2048, 64, OpenSSL::Digest::SHA512.new).bth
+      OpenSSL::PKCS5.pbkdf2_hmac(normalize(mnemonic.join(' ')).downcase,
+                                 'mnemonic' + normalize(passphrase), 2048, 64, OpenSSL::Digest::SHA512.new).bth
     end
 
     # calculate entropy checksum
@@ -69,7 +69,12 @@ module Bitcoin
 
     # load word list contents
     def load_words
-      File.readlines("#{WORD_DIR}/#{language}.txt").map(&:strip)
+      File.readlines("#{WORD_DIR}/#{language}.txt", encoding: Encoding::UTF_8).map{|w| normalize(w.strip)}
+    end
+
+    # BIP-39 requires that mnemonic sentences and passphrases are normalized using NFKD.
+    def normalize(str)
+      str.unicode_normalize(:nfkd)
     end
 
   end

data/lib/bitcoin/partial_tree.rb

@@ -4,6 +4,10 @@ module Bitcoin
   # For a complete Merkle tree implementation, migrate to the merkle gem.
   class PartialTree
 
+    # The maximum number of transactions a block can contain, so the maximum tx_count
+    # a valid merkleblock message can commit to.
+    MAX_TX_COUNT = MAX_BLOCK_WEIGHT / MIN_TRANSACTION_WEIGHT
+
     attr_accessor :root
 
     def initialize(root = nil)
@@ -15,7 +19,13 @@ module Bitcoin
     end
 
     # https://bitcoin.org/en/developer-reference#creating-a-merkleblock-message
+    # @param [Integer] tx_count The number of transactions in the block.
+    # @param [Array] hashes Array of hash values with hex format.
+    # @param [String] flags The sequence of bits, a string of '0' and '1'.
+    # @return [Bitcoin::PartialTree]
+    # @raise [ArgumentError] If the given parameters are out of range or inconsistent.
     def self.build(tx_count, hashes, flags)
+      validate!(tx_count, hashes, flags)
       flags = flags.each_char.map(&:to_i)
       root = build_initial_tree( Array.new(tx_count) { Node.new })
       current_node = root
@@ -37,7 +47,22 @@ module Bitcoin
       new(root)
     end
 
+    # Validate the parameters of a partial merkle tree.
+    # A merkleblock message is received from an untrusted peer, so these bounds are required
+    # to stop it from making #build allocate an unbounded number of nodes or loop forever.
+    # See Bitcoin Core's CPartialMerkleTree::ExtractMatches.
+    # @raise [ArgumentError]
+    def self.validate!(tx_count, hashes, flags)
+      raise ArgumentError, 'tx_count must be greater than 0.' unless tx_count.is_a?(Integer) && tx_count > 0
+      raise ArgumentError, "tx_count must be less than or equal to #{MAX_TX_COUNT}." if tx_count > MAX_TX_COUNT
+      # There can never be more hashes provided than one for every txid.
+      raise ArgumentError, 'hashes must not be greater than tx_count.' if hashes.size > tx_count
+      # There must be at least one bit per node in the partial tree, and at least one node per hash.
+      raise ArgumentError, 'flags must have at least one bit per hash.' if flags.size < hashes.size
+    end
+
     def self.build_initial_tree(nodes)
+      raise ArgumentError, 'nodes must not be empty.' if nodes.empty?
       while nodes.size != 1
         nodes = nodes.each_slice(2).map { |m|
           parent = Node.new