From 8563178bfdb801757afedba4e30ad6e7c2359e27 Mon Sep 17 00:00:00 2001 From: Yasuhiro Matsumoto Date: Wed, 15 Jul 2026 09:40:55 +0900 Subject: [PATCH] key: combine crashed with unbounded recursion when no valid pubkeys were given, and silently dropped unparseable keys from the result. --- key.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/key.go b/key.go index b1ce7fe..fe5a6a0 100644 --- a/key.go +++ b/key.go @@ -310,6 +310,12 @@ However, if the intent is to check if two existing Nostr pubkeys match a given c continue } + + return fmt.Errorf("invalid key %s: expected 32 or 33 bytes hex", keyhex) + } + + if len(keyGroups) < 2 { + return fmt.Errorf("at least two pubkeys are required") } result.Combinations = make([]Combination, 0, 16)