Bitcoin Core version 0.11.1 released

[Cyrus]

Bitcoin Core version 0.11.1 is now available from:

https://bitcoin.org/bin/bitcoin-core-0.11.1/

This is a new minor version release, bringing security fixes. It is recommended to upgrade to this version as soon as possible.

Please report bugs using the issue tracker at github:

https://github.com/bitcoin/bitcoin/issues

Upgrading and downgrading

How to Upgrade

If you are running an older version, shut it down. Wait until it has completely shut down (which might take a few minutes for older versions), then run the installer (on Windows) or just copy over /Applications/Bitcoin-Qt (on Mac) or bitcoind/bitcoin-qt (on Linux).

Downgrade warning

Because release 0.10.0 and later makes use of headers-first synchronization and parallel block download (see further), the block files and databases are not backwards-compatible with pre-0.10 versions of Bitcoin Core or other software:

Blocks will be stored on disk out of order (in the order they are received, really), which makes it incompatible with some tools or other programs. Reindexing using earlier versions will also not work anymore as a result of this.

The block index database will now hold headers for which no block is stored on disk, which earlier versions won’t support.

If you want to be able to downgrade smoothly, make a backup of your entire data directory. Without this your node will need start syncing (or importing from bootstrap.dat) anew afterwards. It is possible that the data from a completely synchronised 0.10 node may be usable in older versions as-is, but this is not supported and may break as soon as the older version attempts to reindex.

This does not affect wallet forward or backward compatibility. There are no known problems when downgrading from 0.11.x to 0.10.x.

Notable changes

Fix buffer overflow in bundled upnp

Bundled miniupnpc was updated to 1.9.20151008. This fixes a buffer overflow in the XML parser during initial network discovery.

Details can be found here: http://talosintel.com/reports/TALOS-2015-0035/

This applies to the distributed executables only, not when building from source or using distribution provided packages.

Test for LowS signatures before relaying

Make the node require the canonical ‘low-s’ encoding for ECDSA signatures when relaying or mining. This removes a nuisance malleability vector.

Consensus behavior is unchanged.

If widely deployed this change would eliminate the last remaining known vector for nuisance malleability on SIGHASH_ALL P2PKH transactions. On the down-side it will block most transactions made by sufficiently out of date software.

Unlike the other avenues to change txids on transactions this one was randomly violated by all deployed bitcoin software prior to its discovery. So, while other malleability vectors where made non-standard as soon as they were discovered, this one has remained permitted. Even BIP62 did not propose applying this rule to old version transactions, but conforming implementations have become much more common since BIP62 was initially written.

Bitcoin Core has produced compatible signatures since a28fb70e in September 2013, but this didn’t make it into a release until 0.9 in March 2014; Bitcoinj has done so for a similar span of time. Bitcoinjs and electrum have been more recently updated.

This does not replace the need for BIP62 or similar, as miners can still cooperate to break transactions. Nor does it replace the need for wallet software to handle malleability sanely[1]. This only eliminates the cheap and irritating DOS attack.

[1] On the Malleability of Bitcoin Transactions Marcin Andrychowicz, Stefan Dziembowski, Daniel Malinowski, Łukasz Mazurek http://fc15.ifca.ai/preproceedings/bitcoin/paper_9.pdf

0.11.1 Change log

Detailed release notes follow. This overview includes changes that affect behavior, not code moves, refactors and string updates. For convenience in locating the code changes and accompanying discussion, both the pull request and git merge commit are mentioned.

#6438 2531438 openssl: avoid config file load/race
#6439 980f820 Updated URL location of netinstall for Debian
#6384 8e5a969 qt: Force TLS1.0+ for SSL connections
#6471 92401c2 Depends: bump to qt 5.5
#6224 93b606a Be even stricter in processing unrequested blocks
#6571 100ac4e libbitcoinconsensus: avoid a crash in multi-threaded environments
#6545 649f5d9 Do not store more than 200 timedata samples.
#6694 834e299 [QT] fix thin space word wrap line break issue
#6703 1cd7952 Backport bugfixes to 0.11
#6750 5ed8d0b Recent rejects backport to v0.11
#6769 71cc9d9 Test LowS in standardness, removes nuisance malleability vector.
#6789 b4ad73f Update miniupnpc to 1.9.20151008
#6785 b4dc33e Backport to v0.11: In (strCommand == “tx”), return if AlreadyHave()
#6412 0095b9a Test whether created sockets are select()able

Credits

Thanks to everyone who directly contributed to this release:

Adam Weiss
Alex Morcos
Casey Rodarmor
Cory Fields
fanquake
Gregory Maxwell
Jonas Schnelli
J Ross Nicoll
Pavel Janík
Pavel Vasin
Peter Todd
Pieter Wuille
randy-waterhouse
Ross Nicoll
Suhas Daftuar
tailsjoin
฿tcDrak
Tom Harding
Veres Lajos
Wladimir J. van der Laan
And those who contributed additional code review and/or security research:

timothy on IRC for reporting the issue
Vulnerability in miniupnp discovered by Aleksandar Nikolic of Cisco Talos
As well as everyone that helped translating on Transifex.

[pereira4]

Yeah, this has been out for hours. Saw it on reddit, and also saw a thread here. I wonder why at the top of the forum where it says "news" it still haven't changed. They should change immediately, specially when a vulnerability exploit is happening. Tons of people notice Bitcoin updates because of this forum.

[Cyrus]

The news field is updated manually and should be done soon.

[Mikestang]

The buffer overflow bug was something I had been experiencing for a while, it would cause my client to crash, glad to see that has been fixed.

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

[unamis76]

Updates and specially these kinds of updates are always welcome

The buffer overflow bug was something I had been experiencing for a while, it would cause my client to crash, glad to see that has been fixed.

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

RAM, maybe? I'm running a node on a 4GB machine and it crashes every now and then without an apparent cause... I suspect it is an extreme RAM usage. It crashed during stress tests, at least here...

[cellard]

Updates and specially these kinds of updates are always welcome

The buffer overflow bug was something I had been experiencing for a while, it would cause my client to crash, glad to see that has been fixed.

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

RAM, maybe? I'm running a node on a 4GB machine and it crashes every now and then without an apparent cause... I suspect it is an extreme RAM usage. It crashed during stress tests, at least here...

My node has also 4GB of ram and it runs fine. I was having constant crashes, after researching around it turns out that it was 1 module of RAM with faulty memory, which was causing a memory leak when a program took way too much RAM. The client wouldn't stop growing in RAM usage until it collapsed. So I would do a memtest for starters.

[unamis76]

Updates and specially these kinds of updates are always welcome

The buffer overflow bug was something I had been experiencing for a while, it would cause my client to crash, glad to see that has been fixed.

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

RAM, maybe? I'm running a node on a 4GB machine and it crashes every now and then without an apparent cause... I suspect it is an extreme RAM usage. It crashed during stress tests, at least here...

My node has also 4GB of ram and it runs fine. I was having constant crashes, after researching around it turns out that it was 1 module of RAM with faulty memory, which was causing a memory leak when a program took way too much RAM. The client wouldn't stop growing in RAM usage until it collapsed. So I would do a memtest for starters.

Good suggestion, thank you. Unfortunately the machine in question is a VPS.

[shorena]

-snip-
Good suggestion, thank you. Unfortunately the machine in question is a VPS.

RAM issues are usually indicated by "bad alloc" in either the bitcoin or the systems log files.

Edit: I wrote this small bash script to see whether the high memory usage was related to the spam attack:

Code:

#!/bin/bash

date="$(date +%F-%R)" #current date and time
sizebytes="$(bitcoin-cli getmempoolinfo | grep [size,bytes] | egrep -o [0-9]*)"
usedfree="$(free -m | grep "^-/+" | egrep -o [0-9]*)"
mem=()
while read -r line; do
  mem+=("$line")
done <<< "$usedfree"
#echo "${mem[0]}|${mem[1]}"
txp=()
while read -r lines; do
  txp+=("$lines")
done <<< "$sizebytes"
echo "$date|${txp[0]}|${txp[1]}|${mem[0]}|${mem[1]}" >> badalloc.log

I also add a header every 24 hours.

Code:

#!/bin/bash
echo "                | transactions  |memory usage   " >> badalloc.log
echo "yyyy-mm-dd-hh:mm|count|size in b|used|free      " >> badalloc.log
echo "------------------------------------------------" >> badalloc.log

Sample output for today:

Code:

2015-10-21-00:00|3480|48161814|1014|1033
2015-10-21-00:30|4747|48826423|1005|1042
2015-10-21-01:00|4799|49154506|1011|1036
2015-10-21-01:30|3183|46341550|1010|1037
2015-10-21-02:00|3375|46089678|1009|1038
2015-10-21-02:30|5151|47420064|1007|1040
2015-10-21-03:00|3888|47239752|1007|1040
2015-10-21-03:30|3268|45954609|1008|1039
2015-10-21-04:00|3151|45941656|1007|1040
2015-10-21-04:30|5634|47096129|1012|1035
2015-10-21-05:00|3173|45684240|1011|1036
2015-10-21-05:30|3909|46216545|1013|1034
2015-10-21-06:00|3611|46493840|1014|1033
2015-10-21-06:30|2665|45533389|1012|1035
2015-10-21-07:00|2498|45544151|1013|1034
2015-10-21-07:30|3131|45766006|1013|1034
2015-10-21-08:00|2890|45569655|1012|1035
2015-10-21-08:30|2443|45245305|1012|1035
2015-10-21-09:00|2744|45360579|1014|1033
2015-10-21-09:30|5239|46643096|1013|1034
2015-10-21-10:00|2198|45117686|1010|1037
2015-10-21-10:30|2513|45267968|1013|1034
2015-10-21-11:00|2906|45545321|1015|1032
2015-10-21-11:30|5426|46894335|1013|1034
2015-10-21-12:00|3763|46400627|1013|1034
2015-10-21-12:30|3561|45821454|1014|1033
2015-10-21-13:00|2590|45319224|1013|1034
2015-10-21-13:30|5475|46684401|1012|1035
2015-10-21-14:00|3283|45402129|1014|1033
2015-10-21-14:30|3507|45459846|1014|1033
2015-10-21-15:00|2304|45251642|1012|1035
2015-10-21-15:30|3715|45973617|1014|1033
2015-10-21-16:00|4527|46787327|1017|1030
2015-10-21-16:30|2900|45193467|1014|1033
2015-10-21-17:00|4243|46137966|1014|1033
2015-10-21-17:30|3305|45609139|1014|1033
2015-10-21-18:00|3026|45826635|1013|1034
2015-10-21-18:30|4244|46093039|1014|1033
2015-10-21-19:00|3101|45242942|1014|1033
2015-10-21-19:30|6241|46563020|1014|1033
2015-10-21-20:00|4329|46195139|1012|1035
2015-10-21-20:30|5004|46176541|1013|1034

[dothebeats]

The buffer overflow bug was something I had been experiencing for a while, it would cause my client to crash, glad to see that has been fixed.

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

Can you give the specs of your machine? I run a node on my old laptop with 4GB of ram. Still runs on 0.11 but no crashes or whatsoever.

Laptop specs in case you're wondering:

AMD Phenom II N620 2.8 Ghz
AMD Mobility Radeon HD4250
4 GB of ram and a 320GB HDD

If yours is greater, I suspect a faulty memory in that case.

[Bifta]

Can you also add that the minrelaytxfee default was increased? It was part of the new version and that note was also included in the email message on bitcoin-dev announcing this version. The email is here: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-October/011545.html

[Lauda]

Has anyone encountered any problems upgrading from 0.11.0 ? I'm wondering because I barely have any time to upgrade at the moment. If any issues arrive I would not have time to troubleshoot and fix them. The upgrade is recommended, but one can always use that workaround for the flaw that was found.

[shorena]

Has anyone encountered any problems upgrading from 0.11.0 ? I'm wondering because I barely have any time to upgrade at the moment. If any issues arrive I would not have time to troubleshoot and fix them. The upgrade is recommended, but one can always use that workaround for the flaw that was found.

I had no issues, but I never had any issues with core so I might not be that representative.

[Bifta]

Has anyone encountered any problems upgrading from 0.11.0 ? I'm wondering because I barely have any time to upgrade at the moment. If any issues arrive I would not have time to troubleshoot and fix them. The upgrade is recommended, but one can always use that workaround for the flaw that was found.

Some people have reported issues with using this version with Armory. Apparently Armory doesn't enforce lowS signatures while this 0.11.1 does so sometimes transactions sent from Armory don't go through.

[Lauda]

I had no issues, but I never had any issues with core so I might not be that representative.

Yeah, same here. I just quickly upgraded. It looks fine (for now).

Some people have reported issues with using this version with Armory. Apparently Armory doesn't enforce lowS signatures while this 0.11.1 does so sometimes transactions sent from Armory don't go through.

Well, I do not use Armory. I only use Bitcoin Core and thus that is not really relevant to me. Thanks for the information though.

[Meuh6879]

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

i'm with you.
since 0.9.3 ... bitcoin crash for no reason.

so ... i use an auto-restart program : Application Monitor
https://bitcointalk.org/index.php?topic=1114415.msg12386392#msg12386392

work perfectly.

[troleybüs]

Why haven't this thread stickied yet? Older version with flaws is still stickied.

[Lethn]

Do we know if there's going to be any release date or word on when the next version that will solve the blocksize problems? Also, I seem to be getting some akwardness going on with the installer on this version.

[Mikestang]

The buffer overflow bug was something I had been experiencing for a while, it would cause my client to crash, glad to see that has been fixed.

Core is still randomly crashing for me from time to time, but I think that is because I run it on a very old system.  I have not been able to pinpoint the cause of most of my crashes, and the log file doesn't give any clues.

Can you give the specs of your machine? I run a node on my old laptop with 4GB of ram. Still runs on 0.11 but no crashes or whatsoever.

Laptop specs in case you're wondering:

AMD Phenom II N620 2.8 Ghz
AMD Mobility Radeon HD4250
4 GB of ram and a 320GB HDD

If yours is greater, I suspect a faulty memory in that case.

Memory has been brought to my attention before as a likely culprit.  My machine is old, here are it's specs:

Intel Core2 6600 @ 2.40 GHz
Nvidia GeForce GTX 550 Ti
4 GB ram, but WinXP only sees 2.75 GB
1 TB+ 7200 rpm of HD space on 3 physical drives

I will run memtest just for fun, but it's probably just the age and architecture of my machine that crashes core.

i'm with you.
since 0.9.3 ... bitcoin crash for no reason.

so ... i use an auto-restart program : Application Monitor
https://bitcointalk.org/index.php?topic=1114415.msg12386392#msg12386392

work perfectly.

When bitnodes emails me that my node is down I can VPN to my machine and restart core.

[Icon]

well for me 0.11.1 fixed the huge memory usage i am back down to 500 meg (from 2 gb of ram running) of ram like the other 2 qt's i run.. And no i didn't have any problems upgrading from 0.11 to 0.11.1


Icon


** little update ***

Noticed twice now if the pc running the qt loses power the bitcoin Dbase crashes and wants to start from the beginning ~ 6 years.. Now the older versions didn't have that problem

[Velkro]

No significant reason to upgrade for me.
But its great developers keep this project up to date