TransactionOutput: make field scriptBytes immutable

schildbach · Feb 8, 2025 · 3f3b73f · 3f3b73f
1 parent 4e88ff2
commit 3f3b73f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/core/src/main/java/org/bitcoinj/core/Transaction.java b/core/src/main/java/org/bitcoinj/core/Transaction.java
@@ -1365,8 +1365,9 @@ public synchronized Sha256Hash hashForWitnessSignature(
                             BigInteger.valueOf(output.getValue().getValue()),
                             bosHashOutputs
                     );
-                    bosHashOutputs.write(VarInt.of(output.getScriptBytes().length).serialize());
-                    bosHashOutputs.write(output.getScriptBytes());
+                    byte[] scriptBytes = output.getScriptBytes();
+                    bosHashOutputs.write(VarInt.of(scriptBytes.length).serialize());
+                    bosHashOutputs.write(scriptBytes);
                 }
                 hashOutputs = Sha256Hash.hashTwice(bosHashOutputs.toByteArray());
             } else if (basicSigHashType == SigHash.SINGLE.value && inputIndex < outputs.size()) {
@@ -1375,8 +1376,9 @@ public synchronized Sha256Hash hashForWitnessSignature(
                         BigInteger.valueOf(this.outputs.get(inputIndex).getValue().getValue()),
                         bosHashOutputs
                 );
-                bosHashOutputs.write(VarInt.of(this.outputs.get(inputIndex).getScriptBytes().length).serialize());
-                bosHashOutputs.write(this.outputs.get(inputIndex).getScriptBytes());
+                byte[] scriptBytes = this.outputs.get(inputIndex).getScriptBytes();
+                bosHashOutputs.write(VarInt.of(scriptBytes.length).serialize());
+                bosHashOutputs.write(scriptBytes);
                 hashOutputs = Sha256Hash.hashTwice(bosHashOutputs.toByteArray());
             }
             writeInt32LE(version, bos);

diff --git a/core/src/main/java/org/bitcoinj/core/TransactionOutput.java b/core/src/main/java/org/bitcoinj/core/TransactionOutput.java
@@ -61,7 +61,7 @@ public class TransactionOutput {
 
     // A transaction output has a script used for authenticating that the redeemer is allowed to spend
     // this output.
-    private byte[] scriptBytes;
+    private final byte[] scriptBytes;
 
     // The script bytes are parsed and turned into a Script on demand.
     private Script scriptPubKey;
@@ -288,7 +288,7 @@ public boolean isAvailableForSpending() {
      * @return the scriptBytes
     */
     public byte[] getScriptBytes() {
-        return scriptBytes;
+        return Arrays.copyOf(scriptBytes, scriptBytes.length);
     }
 
     /**