Bitcoin Core will reject descriptor ranges ending at 2^31-1, which could crash the node

Victoria Shinder11 October 2026, 09:392 min read

Bitcoin Core merged pull request 35989 on 8 October into the master branch: a wallet fix for a crash reachable through the importdescriptors RPC. It is a small change — seven files, about sixty changed lines including tests — but it changes what the wallet accepts, and it comes with a release note for that reason.

The bug. A ranged descriptor tells the wallet which child-key indexes to derive. Internally, WalletDescriptor stores the exclusive end of that range in a signed 32-bit integer. A user importing the range [2147483647, 2147483647] — the largest 32-bit index, 2^31-1 — produces an exclusive end of 2^31, which does not fit, turns negative, and aborts the node when the wallet tops up its keypool. An import with no explicit range could hit the same problem if -keypool was set above 2147483647, because the keypool size is then used as the range end.

The fix, in three parts:

1. The exclusive end is checked before the wallet descriptor is created, for both explicit and default ranges. The release note puts it in user terms: importdescriptors now rejects a range ending at 2147483647, and imports without a range when -keypool is above that number, because the wallet cannot store them.
2. The keypool top-up endpoint is computed in a 64-bit integer before its bound is checked — this closes an overflow reachable by calling keypoolrefill with the maximum value after a descriptor has advanced.
3. CheckDescriptorRangeBounds now rejects reversed ranges before subtracting the low end from the high end, closing a separate overflow reported while the PR was open.

The limit is deliberately wallet-specific: scanning RPCs such as scantxoutset and scanblocks still accept 2^31-1 as an inclusive endpoint, since they do not need to store the range.

Who is affected. Nobody imports a descriptor with a range ending at index 2,147,483,647 by accident, so this is not a bug most wallets will meet. It matters for software that builds importdescriptors calls programmatically — wallet backends, watch-only services, tooling that sets ranges or -keypool from configuration — where an unchecked value could take a node down. After the change, such a call returns an error instead.

The process. The author, shuv-amp, opened the PR on 16 August; Rob1Ham reported the reversed-range overflow (polespinasa linked it to the PR), which was added as a separate commit with its own regression test. Reviewer polespinasa pointed out that rejecting ranges that were accepted before is a behaviour change and asked for a release note, which was added. The final ACKs came from molnard and achow101, who merged it. The author reports testing under UndefinedBehaviorSanitizer with 34 targeted unit cases and the relevant functional tests.

As a master-branch merge, the change is headed for the next major release; the PR does not say whether it will be backported.

Sources: Bitcoin Core PR 35989, merged 8 October 2026 — https://github.com/bitcoin/bitcoin/pull/35989 ; release note — https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes-35989.md