transaction.c

/** \file transaction.c
  *
  * \brief Contains functions specific to Bitcoin transactions.
  *
  * There are two main things which are dealt with in this file.
  * The first is the parsing of Bitcoin transactions. During the parsing
  * process, useful stuff (such as output addresses and amounts) is
  * extracted. See the code of parseTransactionInternal() for the guts.
  *
  * The second is the generation of Bitcoin-compatible signatures. Bitcoin
  * uses OpenSSL to generate signatures, and OpenSSL insists on encapsulating
  * the "r" and "s" values (see ecdsaSign()) in DER format. See the code of
  * signTransaction() for the guts.
  *
  * This file is licensed as described by the file LICENCE.
  */

#ifdef TEST
#include <stdlib.h>
#include <stdio.h>
#endif // #ifdef TEST

#ifdef TEST_TRANSACTION
#include "test_helpers.h"
#include "stream_comm.h"
#include "wallet.h"
#endif // #ifdef TEST_TRANSACTION

#include "common.h"
#include "endian.h"
#include "ecdsa.h"
#include "baseconv.h"
#include "sha256.h"
#include "bignum256.h"
#include "prandom.h"
#include "hwinterface.h"
#include "transaction.h"

/** The maximum size of a transaction (in bytes) which parseTransaction()
  * is prepared to handle. */
#define MAX_TRANSACTION_SIZE	2000000
/** The maximum number of inputs that the transaction parser is prepared
  * to handle. This should be small enough that a transaction with the
  * maximum number of inputs is still less than #MAX_TRANSACTION_SIZE bytes in
  * size.
  * \warning This must be < 65536, otherwise an integer overflow may occur.
  */
#define MAX_INPUTS				5000
/** The maximum number of outputs that the transaction parser is prepared
  * to handle. This should be small enough that a transaction with the
  * maximum number of outputs is still less than #MAX_TRANSACTION_SIZE bytes
  * in size.
  * \warning This must be < 65536, otherwise an integer overflow may occur.
  */
#define MAX_OUTPUTS				2000

/** The maximum amount that can appear in an output, stored as a little-endian
  * multi-precision integer. This represents 21 million BTC. */
static const uint8_t max_money[] = {
0x00, 0x40, 0x07, 0x5A, 0xF0, 0x75, 0x07, 0x00};

/** The transaction fee amount, calculated as output amounts subtracted from
  * input amounts. */
static uint8_t transaction_fee_amount[8];

/** Where the transaction parser is within a transaction. 0 = first byte,
  * 1 = second byte etc. */
static uint32_t transaction_data_index;
/** The total length of the transaction being parsed, in number of bytes. */
static uint32_t transaction_length;
/** If this is true, then as the transaction contents are read from the
  * stream device, they will not be included in the calculation of the
  * transaction hash (see parseTransaction() for what this is all about).
  * If this is false, then they will be included. */
static bool suppress_transaction_hash;
/** If this is false, then as the transaction contents are read from the
  * stream device, they will not be included in the calculation of the
  * transaction hash or the signature hash. If this is true, then they
  * will be included. This is used to stop #sig_hash_hs_ptr
  * and #transaction_hash_hs_ptr from being written to if they don't point
  * to a valid hash state. */
static bool hs_ptr_valid;
/** Pointer to hash state used to calculate the signature
  * hash (see parseTransaction() for what this is all about).
  * \warning If this does not point to a valid hash state structure, ensure
  *          that #hs_ptr_valid is false to
  *          stop getTransactionBytes() from attempting to dereference this.
  */
static HashState *sig_hash_hs_ptr;
/** Pointer to hash state used to calculate the transaction
  * hash (see parseTransaction() for what this is all about).
  * \warning If this does not point to a valid hash state structure, ensure
  *          that #hs_ptr_valid is false to
  *          stop getTransactionBytes() from attempting to dereference this.
  */
static HashState *transaction_hash_hs_ptr;

/** Get transaction data by reading from the stream device, checking that
  * the read operation won't go beyond the end of the transaction data.
  * 
  * Since all transaction data is read using this function, the updating
  * of #sig_hash_hs_ptr and #transaction_hash_hs_ptr is also done.
  * \param buffer An array of bytes which will be filled with the transaction
  *               data (if everything goes well). It must have space for
  *               length bytes.
  * \param length The number of bytes to read from the stream device.
  * \return false on success, true if a stream read error occurred or if the
  *         read would go beyond the end of the transaction data.
  */
static bool getTransactionBytes(uint8_t *buffer, uint8_t length)
{
	uint8_t i;
	uint8_t one_byte;

	if (transaction_data_index > (0xffffffff - (uint32_t)length))
	{
		// transaction_data_index + (uint32_t)length will overflow.
		// Since transaction_length <= 0xffffffff, this implies that the read
		// will go past the end of the transaction.
		return true; // trying to read past end of transaction
	}
	if (transaction_data_index + (uint32_t)length > transaction_length)
	{
		return true; // trying to read past end of transaction
	}
	else
	{
		for (i = 0; i < length; i++)
		{
			one_byte = streamGetOneByte();
			buffer[i] = one_byte;
			if (hs_ptr_valid)
			{
				sha256WriteByte(sig_hash_hs_ptr, one_byte);
				if (!suppress_transaction_hash)
				{
					sha256WriteByte(transaction_hash_hs_ptr, one_byte);
				}
			}
			transaction_data_index++;
		}
		return false;
	}
}

/** Checks whether the transaction parser is at the end of the transaction
  * data.
  * \return false if not at the end of the transaction data, true if at the
  *         end of the transaction data.
  */
static bool isEndOfTransactionData(void)
{
	if (transaction_data_index >= transaction_length)
	{
		return true;
	}
	else
	{
		return false;
	}
}

/** Parse a variable-sized integer within a transaction. Variable sized
  * integers are commonly used to represent counts or sizes in Bitcoin
  * transactions.
  * This only supports unsigned variable-sized integers up to a maximum
  * value of 2 ^ 32 - 1.
  * \param out The value of the integer will be written to here.
  * \return false on success, true to indicate an error occurred (unexpected
  *         end of transaction data or the value of the integer is too large).
  */
static bool getVarInt(uint32_t *out)
{
	uint8_t temp[4];

	if (getTransactionBytes(temp, 1))
	{
		return true; // unexpected end of transaction data
	}
	if (temp[0] < 0xfd)
	{
		*out = temp[0];
	}
	else if (temp[0] == 0xfd)
	{
		if (getTransactionBytes(temp, 2))
		{
			return true; // unexpected end of transaction data
		}
		*out = (uint32_t)(temp[0]) | ((uint32_t)(temp[1]) << 8);
	}
	else if (temp[0] == 0xfe)
	{
		if (getTransactionBytes(temp, 4))
		{
			return true; // unexpected end of transaction data
		}
		*out = readU32LittleEndian(temp);
	}
	else
	{
		return true; // varint is too large
	}
	return false; // success
}

/** See comments for parseTransaction() for description of what this does
  * and return values. However, the guts of the transaction parser are in
  * the code to this function.
  * 
  * This is called once for each input transaction and once for the spending
  * transaction.
  * \param sig_hash See parseTransaction().
  * \param transaction_hash See parseTransaction().
  * \param is_ref_out On success, this will be written with true
  *                   if the transaction parser parsed an input (i.e.
  *                   referenced by input of spending) transaction. This will
  *                   be written with false if the transaction parser parsed
  *                   the main (i.e. spending) transaction.
  * \param ref_compare_hs Reference compare hash. This is used to check that
  *                       the input transactions match the references in the
  *                       main transaction.
  * \return See parseTransaction().
  */
static TransactionErrors parseTransactionInternal(BigNum256 sig_hash, BigNum256 transaction_hash, bool *is_ref_out, HashState *ref_compare_hs)
{
	uint8_t temp[32];
	uint8_t ref_compare_hash[32];
	uint32_t num_inputs;
	uint32_t num_outputs;
	uint32_t script_length;
	uint8_t input_reference_num_buffer[4];
	uint16_t i;
	uint8_t j;
	uint32_t k;
	uint32_t output_num_select;
	bool is_ref;
	char text_amount[TEXT_AMOUNT_LENGTH];
	char text_address[TEXT_ADDRESS_LENGTH];

	if (transaction_length > MAX_TRANSACTION_SIZE)
	{
		return TRANSACTION_TOO_LARGE; // transaction too large
	}

	// Suppress hashing of input stream, otherwise the is_ref byte and
	// output number (which are not part of the transaction data) will
	// be included in the signature/transaction hash.
	hs_ptr_valid = false;

	if (getTransactionBytes(temp, 1))
	{
		return TRANSACTION_INVALID_FORMAT; // transaction truncated
	}
	if (temp[0] != 0)
	{
		is_ref = true;
	}
	else
	{
		is_ref = false;
	}
	*is_ref_out = is_ref;

	output_num_select = 0;
	if (is_ref)
	{
		// Get output number to add to total amount.
		if (getTransactionBytes(temp, 4))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated
		}
		for (j = 0; j < 4; j++)
		{
			sha256WriteByte(ref_compare_hs, temp[j]);
		}
		output_num_select = readU32LittleEndian(temp);
	}
	else
	{
		// Generate hash of input transaction references for comparison.
		sha256FinishDouble(ref_compare_hs);
		writeHashToByteArray(ref_compare_hash, ref_compare_hs, false);
		sha256Begin(ref_compare_hs);
	}

	sha256Begin(sig_hash_hs_ptr);
	sha256Begin(transaction_hash_hs_ptr);
	hs_ptr_valid = true;
	suppress_transaction_hash = false;

	// Check version.
	if (getTransactionBytes(temp, 4))
	{
		return TRANSACTION_INVALID_FORMAT; // transaction truncated
	}
	if (readU32LittleEndian(temp) != 0x00000001)
	{
		return TRANSACTION_NON_STANDARD; // unsupported transaction version
	}

	// Get number of inputs.
	if (getVarInt(&num_inputs))
	{
		return TRANSACTION_INVALID_FORMAT; // transaction truncated or varint too big
	}
	if (num_inputs == 0)
	{
		return TRANSACTION_INVALID_FORMAT; // invalid transaction
	}
	if (num_inputs > MAX_INPUTS)
	{
		return TRANSACTION_TOO_MANY_INPUTS; // too many inputs
	}

	// Process each input.
	for (i = 0; i < num_inputs; i++)
	{
		// Get input transaction reference hash.
		if (getTransactionBytes(temp, 32))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated
		}
		// Get input transaction reference number.
		if (getTransactionBytes(input_reference_num_buffer, 4))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated
		}
		if (!is_ref)
		{
			for (j = 0; j < 4; j++)
			{
				sha256WriteByte(ref_compare_hs, input_reference_num_buffer[j]);
			}
			for (j = 0; j < 32; j++)
			{
				sha256WriteByte(ref_compare_hs, temp[j]);
			}
		}
		// The Bitcoin protocol for signing a transaction involves replacing
		// the corresponding input script with the output script that
		// the input references. This means that the transaction data parsed
		// here will be different depending on which input is being signed
		// for. The transaction hash is supposed to be the same regardless of
		// which input is being signed for, so the calculation of the
		// transaction hash ignores input scripts.
		suppress_transaction_hash = true;
		// Get input script length.
		if (getVarInt(&script_length))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated or varint too big
		}
		// Skip the script because it's useless here.
		for (k = 0; k < script_length; k++)
		{
			if (getTransactionBytes(temp, 1))
			{
				return TRANSACTION_INVALID_FORMAT; // transaction truncated
			}
		}
		suppress_transaction_hash = false;
		// Check sequence. Since locktime is checked below, this check
		// is probably superfluous. But it's better to be safe than sorry.
		if (getTransactionBytes(temp, 4))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated
		}
		if (readU32LittleEndian(temp) != 0xFFFFFFFF)
		{
			return TRANSACTION_NON_STANDARD; // replacement not supported
		}
	} // end for (i = 0; i < num_inputs; i++)

	if (!is_ref)
	{
		// Compare input references with input transactions.
		sha256FinishDouble(ref_compare_hs);
		writeHashToByteArray(temp, ref_compare_hs, false);
		if (memcmp(temp, ref_compare_hash, 32))
		{
			return TRANSACTION_INVALID_REFERENCE; // references don't match input transactions
		}
	}

	// Get number of outputs.
	if (getVarInt(&num_outputs))
	{
		return TRANSACTION_INVALID_FORMAT; // transaction truncated or varint too big
	}
	if (num_outputs == 0)
	{
		return TRANSACTION_INVALID_FORMAT; // invalid transaction
	}
	if (num_outputs > MAX_OUTPUTS)
	{
		return TRANSACTION_TOO_MANY_OUTPUTS; // too many outputs
	}
	if (is_ref)
	{
		if (output_num_select >= num_outputs)
		{
			return TRANSACTION_INVALID_REFERENCE; // bad reference number
		}
	}

	// Process each output.
	for (i = 0; i < num_outputs; i++)
	{
		// Get output amount.
		if (getTransactionBytes(temp, 8))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated
		}
		if (bigCompareVariableSize(temp, (uint8_t *)max_money, 8) == BIGCMP_GREATER)
		{
			return TRANSACTION_INVALID_AMOUNT; // amount too high
		}
		if (is_ref)
		{
			if (i == output_num_select)
			{
				if (bigAddVariableSizeNoModulo(transaction_fee_amount, transaction_fee_amount, temp, 8))
				{
					return TRANSACTION_INVALID_AMOUNT; // overflow occurred (carry occurred)
				}
			}
		}
		else
		{
			if (bigSubtractVariableSizeNoModulo(transaction_fee_amount, transaction_fee_amount, temp, 8))
			{
				return TRANSACTION_INVALID_AMOUNT; // overflow occurred (borrow occurred)
			}
			amountToText(text_amount, temp);
		}
		// Get output script length.
		if (getVarInt(&script_length))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated or varint too big
		}
		if (is_ref)
		{
			// The actual output scripts of input transactions don't need to
			// be parsed (only the amount matters), so skip the script.
			for (k = 0; k < script_length; k++)
			{
				if (getTransactionBytes(temp, 1))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
			}
		}
		else
		{
			// Parsing a spending transaction; output scripts need to be
			// matched to a template.
			if (script_length == 0x19)
			{
				// Expect a standard, pay to public key hash output script.
				// Look for: OP_DUP, OP_HASH160, (20 bytes of data).
				if (getTransactionBytes(temp, 3))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
				if ((temp[0] != 0x76) || (temp[1] != 0xa9) || (temp[2] != 0x14))
				{
					return TRANSACTION_NON_STANDARD; // nonstandard transaction
				}
				if (getTransactionBytes(temp, 20))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
				hashToAddr(text_address, temp, ADDRESS_VERSION_PUBKEY);
				// Look for: OP_EQUALVERIFY OP_CHECKSIG.
				if (getTransactionBytes(temp, 2))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
				if ((temp[0] != 0x88) || (temp[1] != 0xac))
				{
					return TRANSACTION_NON_STANDARD; // nonstandard transaction
				}
			} // end if (script_length == 0x19)
			else if (script_length == 0x17)
			{
				// Expect a standard, pay to script hash output script.
				// Look for: OP_HASH160, (20 bytes of data).
				if (getTransactionBytes(temp, 2))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
				if ((temp[0] != 0xa9) || (temp[1] != 0x14))
				{
					return TRANSACTION_NON_STANDARD; // nonstandard transaction
				}
				if (getTransactionBytes(temp, 20))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
				hashToAddr(text_address, temp, ADDRESS_VERSION_P2SH);
				// Look for: OP_EQUAL.
				if (getTransactionBytes(temp, 1))
				{
					return TRANSACTION_INVALID_FORMAT; // transaction truncated
				}
				if (temp[0] != 0x87)
				{
					return TRANSACTION_NON_STANDARD; // nonstandard transaction
				}
			} // end if (script_length == 0x17)
			else
			{
				return TRANSACTION_NON_STANDARD; // nonstandard transaction
			}
			if (newOutputSeen(text_amount, text_address))
			{
				return TRANSACTION_TOO_MANY_OUTPUTS; // too many outputs
			}
		} // end if (is_ref)
	} // end for (i = 0; i < num_outputs; i++)

	// Check locktime.
	if (getTransactionBytes(temp, 4))
	{
		return TRANSACTION_INVALID_FORMAT; // transaction truncated
	}
	if (readU32LittleEndian(temp) != 0x00000000)
	{
		return TRANSACTION_NON_STANDARD; // replacement not supported
	}

	if (!is_ref)
	{
		// Check hashtype.
		if (getTransactionBytes(temp, 4))
		{
			return TRANSACTION_INVALID_FORMAT; // transaction truncated
		}
		if (readU32LittleEndian(temp) != 0x00000001)
		{
			return TRANSACTION_NON_STANDARD; // nonstandard transaction
		}

		// Is there junk at the end of the transaction data?
		if (!isEndOfTransactionData())
		{
			return TRANSACTION_INVALID_FORMAT; // junk at end of transaction data
		}

		if (!bigIsZeroVariableSize(transaction_fee_amount, sizeof(transaction_fee_amount)))
		{
			amountToText(text_amount, transaction_fee_amount);
			setTransactionFee(text_amount);
		}
	}

	sha256FinishDouble(sig_hash_hs_ptr);
	// The signature hash is written in a little-endian format because it
	// is used as a little-endian multi-precision integer in
	// signTransaction().
	writeHashToByteArray(sig_hash, sig_hash_hs_ptr, false);
	sha256FinishDouble(transaction_hash_hs_ptr);
	writeHashToByteArray(transaction_hash, transaction_hash_hs_ptr, false);

	if (is_ref)
	{
		// Why backwards? Because Bitcoin serialises the input reference
		// hashes that way.
		for (j = 32; j--; )
		{
			sha256WriteByte(ref_compare_hs, sig_hash[j]);
		}
	}

	return TRANSACTION_NO_ERROR;
}

/** Parse a Bitcoin transaction, extracting the output amounts/addresses,
  * validating the transaction (ensuring that it is "standard") and computing
  * a double SHA-256 hash of the transaction. This double SHA-256 hash is the
  * "signature hash" because it is the hash which is passed on to the signing
  * function signTransaction().
  *
  * The Bitcoin protocol for signing a transaction involves replacing
  * the corresponding input script with the output script that
  * the input references. This means that for a transaction with n
  * inputs, there will be n different signature hashes - one for each input.
  * Requiring the user to approve a transaction n times would be very
  * annoying, so there needs to be a way to determine whether a bunch of
  * transactions are actually "the same".
  * So in addition to the signature hash, a "transaction hash" will be
  * computed. The transaction hash is just like the signature hash, except
  * input scripts are not included.
  *
  * This expects the input stream to contain many concatenated transactions;
  * it should contain each input transaction (of the spending transaction)
  * followed by the spending transaction. This is necessary
  * to calculate the transaction fee. A transaction does directly contain the
  * output amounts, but not the input amounts. The only way to get input
  * amounts is to look at the output amounts of the transactions the inputs
  * refer to.
  *
  * \param sig_hash The signature hash will be written here (if everything
  *                 goes well), as a 32 byte little-endian multi-precision
  *                 number.
  * \param transaction_hash The transaction hash will be written here (if
  *                         everything goes well), as a 32 byte little-endian
  *                         multi-precision number.
  * \param length The total length of the transaction. If no stream read
  *               errors occured, then exactly length bytes will be read from
  *               the stream, even if the transaction was not parsed
  *               correctly.
  * \return One of the values in #TransactionErrorsEnum.
  */
TransactionErrors parseTransaction(BigNum256 sig_hash, BigNum256 transaction_hash, uint32_t length)
{
	TransactionErrors r;
	uint8_t junk;
	bool is_ref;
	HashState sig_hash_hs;
	HashState transaction_hash_hs;
	HashState ref_compare_hs;

	hs_ptr_valid = false;
	transaction_data_index = 0;
	transaction_length = length;
	memset(transaction_fee_amount, 0, sizeof(transaction_fee_amount));
	sig_hash_hs_ptr = &sig_hash_hs;
	transaction_hash_hs_ptr = &transaction_hash_hs;
	sha256Begin(&ref_compare_hs);

	hs_ptr_valid = true;
	do
	{
		r = parseTransactionInternal(sig_hash, transaction_hash, &is_ref, &ref_compare_hs);
	} while ((r == TRANSACTION_NO_ERROR) && is_ref);
	hs_ptr_valid = false;

	// Always try to consume the entire stream.
	while (!isEndOfTransactionData())
	{
		if (getTransactionBytes(&junk, 1))
		{
			break;
		}
	}
	return r;
}

/**
 * \defgroup DEROffsets Offsets for DER signature encapsulation.
 *
 * @{
 */
/** Initial offset of r in signature. It's 4 because 4 bytes are needed for
  * the SEQUENCE/length and INTEGER/length bytes. */
#define R_OFFSET	4
/** Initial offset of s in signature. It's 39 because: r is initially 33
  * bytes long, and 2 bytes are needed for INTEGER/length. 4 + 33 + 2 = 39. */
#define S_OFFSET	39
/**@}*/

/** Encapsulate an ECDSA signature in the DER format which OpenSSL uses.
  * This function does not fail.
  * \param signature This must be a byte array with space for at
  *                  least #MAX_SIGNATURE_LENGTH bytes. On exit, the
  *                  encapsulated signature will be written here.
  * \param r The r value of the ECDSA signature. This should be a 32 byte
  *          little-endian multi-precision integer.
  * \param s The s value of the ECDSA signature. This should be a 32 byte
  *          little-endian multi-precision integer.
  * \return The length of the signature, in number of bytes.
  */
static uint8_t encapsulateSignature(uint8_t *signature, BigNum256 r, BigNum256 s)
{
	uint8_t sequence_length;
	uint8_t i;

	memcpy(&(signature[R_OFFSET + 1]), r, 32);
	memcpy(&(signature[S_OFFSET + 1]), s, 32);
	// Place an extra leading zero in front of r and s, just in case their
	// most significant bit is 1.
	// Integers in DER are always 2s-complement signed, but r and s are
	// non-negative. Thus if the most significant bit of r or s is 1,
	// a leading zero must be placed in front of the integer to signify that
	// it is non-negative.
	// If the most significant bit is not 1, the extraneous leading zero will
	// be removed in a check below.
	signature[R_OFFSET] = 0x00;
	signature[S_OFFSET] = 0x00;

	// Integers in DER are big-endian.
	swapEndian256(&(signature[R_OFFSET + 1]));
	swapEndian256(&(signature[S_OFFSET + 1]));

	sequence_length = 0x46; // 2 + 33 + 2 + 33
	signature[R_OFFSET - 2] = 0x02; // INTEGER
	signature[R_OFFSET - 1] = 0x21; // length of INTEGER
	signature[S_OFFSET - 2] = 0x02; // INTEGER
	signature[S_OFFSET - 1] = 0x21; // length of INTEGER
	signature[S_OFFSET + 33] = 0x01; // hashtype
	// According to DER, integers should be represented using the shortest
	// possible representation. This implies that leading zeroes should
	// always be removed. The exception to this is that if removing the
	// leading zero would cause the value of the integer to change (eg.
	// positive to negative), the leading zero should remain.

	// Remove unncecessary leading zeroes from s. s is pruned first
	// because pruning r will modify the offset where s begins.
	while ((signature[S_OFFSET] == 0) && ((signature[S_OFFSET + 1] & 0x80) == 0))
	{
		for (i = S_OFFSET; i < 72; i++)
		{
			signature[i] = signature[i + 1];
		}
		sequence_length--;
		signature[S_OFFSET - 1]--;
		if (signature[S_OFFSET - 1] == 1)
		{
			break;
		}
	}

	// Remove unnecessary leading zeroes from r.
	while ((signature[R_OFFSET] == 0) && ((signature[R_OFFSET + 1] & 0x80) == 0))
	{
		for (i = R_OFFSET; i < 72; i++)
		{
			signature[i] = signature[i + 1];
		}
		sequence_length--;
		signature[R_OFFSET - 1]--;
		if (signature[R_OFFSET - 1] == 1)
		{
			break;
		}
	}

	signature[0] = 0x30; // SEQUENCE
	signature[1] = sequence_length; // length of SEQUENCE
	// 3 extra bytes: SEQUENCE/length and hashtype
	return (uint8_t)(sequence_length + 3);
}

/** Sign a transaction. This should be called after the transaction is parsed
  * and a signature hash has been computed. The primary purpose of this
  * function is to call ecdsaSign() and encapsulate the ECDSA signature in
  * the DER format which OpenSSL uses.
  * \param signature The encapsulated signature will be written here. This
  *                  must be a byte array with space for
  *                  at least #MAX_SIGNATURE_LENGTH bytes.
  * \param out_length The length of the signature, in number of bytes, will be
  *                   written here (on success). This length includes the hash
  *                   type byte.
  * \param sig_hash The signature hash of the transaction (see
  *                 parseTransaction()).
  * \param private_key The private key to sign the transaction with. This must
  *                    be a 32 byte little-endian multi-precision integer.
  * \return false on success, or true if an error occurred while trying to
  *         obtain a random number.
  */
void signTransaction(uint8_t *signature, uint8_t *out_length, BigNum256 sig_hash, BigNum256 private_key)
{
	uint8_t r[32];
	uint8_t s[32];

	*out_length = 0;
	ecdsaSign(r, s, sig_hash, private_key);
	*out_length = encapsulateSignature(signature, r, s);
}

#ifdef TEST

/** Number of outputs seen. */
static int num_outputs_seen;

bool newOutputSeen(char *text_amount, char *text_address)
{
	printf("Amount: %s\n", text_amount);
	printf("Address: %s\n", text_address);
	num_outputs_seen++;
	return false; // success
}

void setTransactionFee(char *text_amount)
{
	printf("Transaction fee: %s\n", text_amount);
}

void clearOutputsSeen(void)
{
	num_outputs_seen = 0;
}

#endif // #ifdef TEST

#ifdef TEST_TRANSACTION

/** A known good test transaction. This one was intercepted from the original
  * Bitcoin client during the signing of a live transaction. The input
  * references and addresses have been changed to protect privacy. */
static const uint8_t good_full_transaction[] = {
// The first (and only) input transaction.
// This isn't part of the intercepted transaction; it was obtained from
// blockexplorer.com.
0x01, // is_ref = 1 (input)
0x01, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xdf, 0x08, 0xf9, 0xa3, 0x7c, 0x6d, 0x71, 0x3c, // previous output
0x6a, 0x99, 0x2e, 0x88, 0x29, 0x8e, 0x0b, 0x4c,
0x8f, 0xb5, 0xf9, 0x0e, 0x11, 0xf0, 0x2c, 0xa7,
0x36, 0x72, 0xeb, 0x58, 0xb3, 0x04, 0xef, 0xc0,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x8a, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x1b, 0xf4, 0xef, 0x3c, 0x34, 0x96, 0x02, 0x9b, 0x1a,
0xb1, 0xc8, 0x49, 0xbf, 0x18, 0x55, 0xcc, 0x16, 0xbc, 0x52, 0x6d, 0xcc, 0x20,
0xfb, 0x7c, 0x0a, 0x1d, 0x48, 0xd6, 0xe9, 0xbd, 0xd7, 0xb1, 0x02, 0x20, 0x53,
0xb1, 0xa3, 0xaa, 0xbf, 0xd3, 0x87, 0x84, 0xdc, 0xf3, 0x10, 0xe5, 0xd2, 0x09,
0xa4, 0xba, 0xb0, 0x01, 0x62, 0xe5, 0xbc, 0x09, 0x75, 0x9d, 0x4f, 0x74, 0x2c,
0xb4, 0x6b, 0x32, 0x37, 0x2c, 0x01,
0x41, // 65 bytes of data follows
0x04, 0x05, 0x4d, 0xb5, 0xe0, 0x8e, 0x2a, 0x33, 0x89, 0x2c, 0xf3, 0x4b, 0x7e,
0xbc, 0x18, 0x3b, 0xa5, 0xf5, 0x54, 0xc6, 0x9d, 0x6d, 0x21, 0x65, 0x60, 0x89,
0xf5, 0x5e, 0x2d, 0x0f, 0x3a, 0x68, 0x08, 0x23, 0x83, 0x19, 0xcd, 0x89, 0xba,
0xda, 0x09, 0x9b, 0xc6, 0xef, 0x3f, 0xdc, 0x80, 0xd8, 0x7a, 0xb2, 0xbf, 0x2b,
0x37, 0x18, 0xdd, 0x4a, 0x4e, 0x36, 0x09, 0x60, 0x28, 0x6e, 0x2e, 0x77, 0x57,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xc0, 0xa4, 0x70, 0x57, 0x00, 0x00, 0x00, 0x00, // 14.67 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 1Q6W8HTPdwccCkLRMLJpYkGvweKhpsKKjE
0xfd, 0x55, 0x49, 0x20, 0x22, 0xa0, 0x3f, 0xf7, 0x7a, 0x9d,
0xe0, 0x0d, 0xa2, 0x18, 0x08, 0x0c, 0xa9, 0x51, 0xde, 0xef,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x54, 0x92, 0x3d, 0x00, 0x00, 0x00, 0x00, // 10.33 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16E7VhudyU3iXNddNazG8sChjQwfWcrHNw
0x39, 0x53, 0x75, 0x46, 0x88, 0x84, 0x3d, 0xe5, 0x50, 0x0b,
0x79, 0x91, 0x33, 0x7f, 0x96, 0xf5, 0x41, 0x71, 0x48, 0xa1,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
// The main (spending) transaction.
0x00, // is_ref = 0 (main)
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01234567 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16eCeyy63xi5yde9VrX4XCcRrCKZwtUZK
0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The input transaction from #good_full_transaction. */
static const uint8_t good_input_transaction[] = {
0x01, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xdf, 0x08, 0xf9, 0xa3, 0x7c, 0x6d, 0x71, 0x3c, // previous output
0x6a, 0x99, 0x2e, 0x88, 0x29, 0x8e, 0x0b, 0x4c,
0x8f, 0xb5, 0xf9, 0x0e, 0x11, 0xf0, 0x2c, 0xa7,
0x36, 0x72, 0xeb, 0x58, 0xb3, 0x04, 0xef, 0xc0,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x8a, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x1b, 0xf4, 0xef, 0x3c, 0x34, 0x96, 0x02, 0x9b, 0x1a,
0xb1, 0xc8, 0x49, 0xbf, 0x18, 0x55, 0xcc, 0x16, 0xbc, 0x52, 0x6d, 0xcc, 0x20,
0xfb, 0x7c, 0x0a, 0x1d, 0x48, 0xd6, 0xe9, 0xbd, 0xd7, 0xb1, 0x02, 0x20, 0x53,
0xb1, 0xa3, 0xaa, 0xbf, 0xd3, 0x87, 0x84, 0xdc, 0xf3, 0x10, 0xe5, 0xd2, 0x09,
0xa4, 0xba, 0xb0, 0x01, 0x62, 0xe5, 0xbc, 0x09, 0x75, 0x9d, 0x4f, 0x74, 0x2c,
0xb4, 0x6b, 0x32, 0x37, 0x2c, 0x01,
0x41, // 65 bytes of data follows
0x04, 0x05, 0x4d, 0xb5, 0xe0, 0x8e, 0x2a, 0x33, 0x89, 0x2c, 0xf3, 0x4b, 0x7e,
0xbc, 0x18, 0x3b, 0xa5, 0xf5, 0x54, 0xc6, 0x9d, 0x6d, 0x21, 0x65, 0x60, 0x89,
0xf5, 0x5e, 0x2d, 0x0f, 0x3a, 0x68, 0x08, 0x23, 0x83, 0x19, 0xcd, 0x89, 0xba,
0xda, 0x09, 0x9b, 0xc6, 0xef, 0x3f, 0xdc, 0x80, 0xd8, 0x7a, 0xb2, 0xbf, 0x2b,
0x37, 0x18, 0xdd, 0x4a, 0x4e, 0x36, 0x09, 0x60, 0x28, 0x6e, 0x2e, 0x77, 0x57,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xc0, 0xa4, 0x70, 0x57, 0x00, 0x00, 0x00, 0x00, // 14.67 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 1Q6W8HTPdwccCkLRMLJpYkGvweKhpsKKjE
0xfd, 0x55, 0x49, 0x20, 0x22, 0xa0, 0x3f, 0xf7, 0x7a, 0x9d,
0xe0, 0x0d, 0xa2, 0x18, 0x08, 0x0c, 0xa9, 0x51, 0xde, 0xef,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x54, 0x92, 0x3d, 0x00, 0x00, 0x00, 0x00, // 10.33 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16E7VhudyU3iXNddNazG8sChjQwfWcrHNw
0x39, 0x53, 0x75, 0x46, 0x88, 0x84, 0x3d, 0xe5, 0x50, 0x0b,
0x79, 0x91, 0x33, 0x7f, 0x96, 0xf5, 0x41, 0x71, 0x48, 0xa1,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
};

/** The main transaction from #good_full_transaction. This must actually be
  * the main transaction from #good_full_transaction, otherwise some tests
  * will complain about hashes not being calculated properly. */
static const uint8_t good_main_transaction[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01234567 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16eCeyy63xi5yde9VrX4XCcRrCKZwtUZK
0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with the inputs
  * removed. */
static const uint8_t inputs_removed_transaction[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0x02, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01234567 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16eCeyy63xi5yde9VrX4XCcRrCKZwtUZK
0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** One input for a transaction. This was extracted
  * from the main transaction in #good_full_transaction. */
static const uint8_t one_input[] = {
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
};

/** One output for a transaction. This was extracted
  * from the main transaction in #good_full_transaction. */
static const uint8_t one_output[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // amount
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// output address
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
};

/** First output amount to use. */
static const uint8_t output_amount1[] = {
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00 // 6 BTC
};

/** Second output amount to use. */
static const uint8_t output_amount2[] = {
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00 // 0.01234567 BTC
};

/** First output address to use. */
static const uint8_t output_address1[] = {
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33
};

/** Second output address to use. */
static const uint8_t output_address2[] = {
// 16eCeyy63xi5yde9VrX4XCcRrCKZwtUZK
0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33
};

/** The main transaction from #good_full_transaction, with the input
  * script set to a blank (zero-length) script. */
static const uint8_t good_main_transaction_blank_script[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x00, // script length
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01234567 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16eCeyy63xi5yde9VrX4XCcRrCKZwtUZK
0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The transaction with the outputs of the main transaction removed.
  * This doesn't use the same input transaction as #good_full_transaction
  * because the total input amount needs to be sufficiently high to stop the
  * transaction parser from complaining about negative transaction fees
  * (which are checked before outputs). The reason why the input amount
  * needs to be high is that when outputs are removed, the parser
  * interprets locktime/hashtype as the output amount. For a standard
  * locktime/hashtype, this is 42.94967296 BTC. */
static const uint8_t outputs_removed_transaction[] = {
// The first (and only) input transaction.
// This is transaction 48be780987de0935ae04a53211872b25557956980124e8b5aba8ae63b9c93db9
// (not mine) from the main blockchain.
0x01, // is_ref = 1 (input)
0x01, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0x5e, 0x10, 0x64, 0xc9, 0x3a, 0x40, 0xb2, 0x32, // previous output
0x14, 0x49, 0x07, 0xfc, 0x30, 0x3c, 0x43, 0xa9,
0x73, 0xd1, 0x66, 0xd7, 0xc1, 0x84, 0x4b, 0x52,
0x12, 0x38, 0xc9, 0x0d, 0x38, 0x56, 0x61, 0x79,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x8b, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x20, 0x7a, 0x25, 0x16, 0x65, 0xea, 0x04, 0x91, 0x2c, 0x31,
0x51, 0x23, 0xe8, 0x62, 0xf8, 0x66, 0x67, 0xd2, 0xfa, 0x65, 0x08, 0xdd, 0x0a,
0xd8, 0x32, 0x4c, 0x52, 0xcb, 0xaa, 0xa3, 0xca, 0x3d, 0x51, 0x02, 0x21, 0x00,
0xcd, 0x95, 0x71, 0x75, 0x7f, 0xc9, 0xd4, 0xad, 0x76, 0x17, 0x07, 0xda, 0x58,
0x4f, 0xdd, 0x7c, 0x08, 0x8d, 0xaf, 0x87, 0xcd, 0x80, 0x37, 0xf9, 0xc3, 0x6a,
0xcb, 0x5f, 0xbd, 0xde, 0x5f, 0x44, 0x01,
0x41, // 65 bytes of data follows
0x04, 0x37, 0x7d, 0xd0, 0xf9, 0x1b, 0x1b, 0xfa, 0x5e, 0x13, 0x56, 0xd3, 0x3c,
0xf2, 0x8b, 0xb5, 0x3a, 0x17, 0xd9, 0x1e, 0x28, 0x79, 0xe0, 0x11, 0xff, 0xfa,
0x4d, 0x4c, 0xf1, 0x1f, 0x6e, 0x6d, 0x3a, 0xde, 0x15, 0xdd, 0x90, 0x74, 0xf3,
0xf9, 0xc3, 0x63, 0x0c, 0x2e, 0x7b, 0xe7, 0x57, 0x34, 0x5b, 0x41, 0x6d, 0x1b,
0x9a, 0xce, 0x71, 0x6e, 0x4f, 0x7c, 0x66, 0x3e, 0xab, 0xb0, 0x5e, 0xe4, 0x2d,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x6f, 0x53, 0xf5, 0xe4, 0x07, 0x00, 0x00, 0x00, // 339.06053999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 1EpM6XVjV9EKuKXdzWeSvo7nBbTdmozUJB
0x97, 0x8d, 0xf5, 0xc7, 0xe8, 0x55, 0x8c, 0x98, 0xd8, 0xba,
0x52, 0x0e, 0x3d, 0xf6, 0xa0, 0x0b, 0x99, 0x79, 0x2b, 0x21,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x91, 0xec, 0xc1, 0x5e, 0xb2, 0x00, 0x00, 0x00, // 7660.93946001 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 1aCW2vs7Xphjea1jyk3ZykYiujvUwSGaC
0x06, 0x47, 0x53, 0xb1, 0xf5, 0xb6, 0x4f, 0x34, 0xfb, 0xfc,
0xe4, 0xa8, 0x0c, 0xe0, 0x4c, 0xc1, 0xa8, 0xa3, 0x4e, 0xf4,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
// The main (spending) transaction.
0x00, // is_ref = 0 (main)
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xb9, 0x3d, 0xc9, 0xb9, 0x63, 0xae, 0xa8, 0xab, // previous output
0xb5, 0xe8, 0x24, 0x01, 0x98, 0x56, 0x79, 0x55,
0x25, 0x2b, 0x87, 0x11, 0x32, 0xa5, 0x04, 0xae,
0x35, 0x09, 0xde, 0x87, 0x09, 0x78, 0xbe, 0x48,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** A transaction which has more outputs than specified. The input
  * amount needs to be high for similar reasons
  * to #outputs_removed_transaction. */
static const uint8_t too_many_outputs_transaction[] = {
// The first (and only) input transaction.
// This is transaction 48be780987de0935ae04a53211872b25557956980124e8b5aba8ae63b9c93db9
// (not mine) from the main blockchain.
0x01, // is_ref = 1 (input)
0x01, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0x5e, 0x10, 0x64, 0xc9, 0x3a, 0x40, 0xb2, 0x32, // previous output
0x14, 0x49, 0x07, 0xfc, 0x30, 0x3c, 0x43, 0xa9,
0x73, 0xd1, 0x66, 0xd7, 0xc1, 0x84, 0x4b, 0x52,
0x12, 0x38, 0xc9, 0x0d, 0x38, 0x56, 0x61, 0x79,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x8b, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x20, 0x7a, 0x25, 0x16, 0x65, 0xea, 0x04, 0x91, 0x2c, 0x31,
0x51, 0x23, 0xe8, 0x62, 0xf8, 0x66, 0x67, 0xd2, 0xfa, 0x65, 0x08, 0xdd, 0x0a,
0xd8, 0x32, 0x4c, 0x52, 0xcb, 0xaa, 0xa3, 0xca, 0x3d, 0x51, 0x02, 0x21, 0x00,
0xcd, 0x95, 0x71, 0x75, 0x7f, 0xc9, 0xd4, 0xad, 0x76, 0x17, 0x07, 0xda, 0x58,
0x4f, 0xdd, 0x7c, 0x08, 0x8d, 0xaf, 0x87, 0xcd, 0x80, 0x37, 0xf9, 0xc3, 0x6a,
0xcb, 0x5f, 0xbd, 0xde, 0x5f, 0x44, 0x01,
0x41, // 65 bytes of data follows
0x04, 0x37, 0x7d, 0xd0, 0xf9, 0x1b, 0x1b, 0xfa, 0x5e, 0x13, 0x56, 0xd3, 0x3c,
0xf2, 0x8b, 0xb5, 0x3a, 0x17, 0xd9, 0x1e, 0x28, 0x79, 0xe0, 0x11, 0xff, 0xfa,
0x4d, 0x4c, 0xf1, 0x1f, 0x6e, 0x6d, 0x3a, 0xde, 0x15, 0xdd, 0x90, 0x74, 0xf3,
0xf9, 0xc3, 0x63, 0x0c, 0x2e, 0x7b, 0xe7, 0x57, 0x34, 0x5b, 0x41, 0x6d, 0x1b,
0x9a, 0xce, 0x71, 0x6e, 0x4f, 0x7c, 0x66, 0x3e, 0xab, 0xb0, 0x5e, 0xe4, 0x2d,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x6f, 0x53, 0xf5, 0xe4, 0x07, 0x00, 0x00, 0x00, // 339.06053999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 1EpM6XVjV9EKuKXdzWeSvo7nBbTdmozUJB
0x97, 0x8d, 0xf5, 0xc7, 0xe8, 0x55, 0x8c, 0x98, 0xd8, 0xba,
0x52, 0x0e, 0x3d, 0xf6, 0xa0, 0x0b, 0x99, 0x79, 0x2b, 0x21,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x91, 0xec, 0xc1, 0x5e, 0xb2, 0x00, 0x00, 0x00, // 7660.93946001 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 1aCW2vs7Xphjea1jyk3ZykYiujvUwSGaC
0x06, 0x47, 0x53, 0xb1, 0xf5, 0xb6, 0x4f, 0x34, 0xfb, 0xfc,
0xe4, 0xa8, 0x0c, 0xe0, 0x4c, 0xc1, 0xa8, 0xa3, 0x4e, 0xf4,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
// The main (spending) transaction.
0x00, // is_ref = 0 (main)
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xb9, 0x3d, 0xc9, 0xb9, 0x63, 0xae, 0xa8, 0xab, // previous output
0xb5, 0xe8, 0x24, 0x01, 0x98, 0x56, 0x79, 0x55,
0x25, 0x2b, 0x87, 0x11, 0x32, 0xa5, 0x04, 0xae,
0x35, 0x09, 0xde, 0x87, 0x09, 0x78, 0xbe, 0x48,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x03, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01234567 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16eCeyy63xi5yde9VrX4XCcRrCKZwtUZK
0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with an output
  * script set to a blank (zero-length) script. */
static const uint8_t good_test_transaction_blank_output_script[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x87, 0xd6, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01234567 BTC
0x00, // script length
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard1[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x18, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard2[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x18, // script length
0x76, // OP_DUP
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard3[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x18, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x13, // 19 bytes of data follows
0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard4[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x1A, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x15, // 21 bytes of data follows
0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xff, 0xff,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard5[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xAA, // OP_HASH256
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard6[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x87, // OP_EQUAL
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** The main transaction from #good_full_transaction, with one output which
  * is non-standard. */
static const uint8_t non_standard7[] = {
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xee, 0xce, 0xae, 0x86, 0xf5, 0x70, 0x4d, 0x76, // previous output
0xb8, 0x54, 0x5e, 0x6d, 0xcf, 0x21, 0xf1, 0x75,
0x35, 0x7f, 0x83, 0xbd, 0xa4, 0x96, 0x43, 0x83,
0xd6, 0xdd, 0x7e, 0x41, 0x68, 0x1b, 0x5e, 0x1a,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
// OP_CHECKSIG spam
0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC,
0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC,
0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC, 0xAC,
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** This is #good_full_transaction, but with the input amount set to
  * 21 million BTC and number of outputs set to 1 so that the output amount
  * checks can be tested. */
static const uint8_t big_amount_full_transaction[] = {
// The first (and only) input transaction.
// This isn't part of the intercepted transaction; it was obtained from
// blockexplorer.com.
0x01, // is_ref = 1 (input)
0x00, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0xdf, 0x08, 0xf9, 0xa3, 0x7c, 0x6d, 0x71, 0x3c, // previous output
0x6a, 0x99, 0x2e, 0x88, 0x29, 0x8e, 0x0b, 0x4c,
0x8f, 0xb5, 0xf9, 0x0e, 0x11, 0xf0, 0x2c, 0xa7,
0x36, 0x72, 0xeb, 0x58, 0xb3, 0x04, 0xef, 0xc0,
0x01, 0x00, 0x00, 0x00, // number in previous output
0x8a, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x1b, 0xf4, 0xef, 0x3c, 0x34, 0x96, 0x02, 0x9b, 0x1a,
0xb1, 0xc8, 0x49, 0xbf, 0x18, 0x55, 0xcc, 0x16, 0xbc, 0x52, 0x6d, 0xcc, 0x20,
0xfb, 0x7c, 0x0a, 0x1d, 0x48, 0xd6, 0xe9, 0xbd, 0xd7, 0xb1, 0x02, 0x20, 0x53,
0xb1, 0xa3, 0xaa, 0xbf, 0xd3, 0x87, 0x84, 0xdc, 0xf3, 0x10, 0xe5, 0xd2, 0x09,
0xa4, 0xba, 0xb0, 0x01, 0x62, 0xe5, 0xbc, 0x09, 0x75, 0x9d, 0x4f, 0x74, 0x2c,
0xb4, 0x6b, 0x32, 0x37, 0x2c, 0x01,
0x41, // 65 bytes of data follows
0x04, 0x05, 0x4d, 0xb5, 0xe0, 0x8e, 0x2a, 0x33, 0x89, 0x2c, 0xf3, 0x4b, 0x7e,
0xbc, 0x18, 0x3b, 0xa5, 0xf5, 0x54, 0xc6, 0x9d, 0x6d, 0x21, 0x65, 0x60, 0x89,
0xf5, 0x5e, 0x2d, 0x0f, 0x3a, 0x68, 0x08, 0x23, 0x83, 0x19, 0xcd, 0x89, 0xba,
0xda, 0x09, 0x9b, 0xc6, 0xef, 0x3f, 0xdc, 0x80, 0xd8, 0x7a, 0xb2, 0xbf, 0x2b,
0x37, 0x18, 0xdd, 0x4a, 0x4e, 0x36, 0x09, 0x60, 0x28, 0x6e, 0x2e, 0x77, 0x57,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x40, 0x07, 0x5A, 0xF0, 0x75, 0x07, 0x00, // 21000000 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 16E7VhudyU3iXNddNazG8sChjQwfWcrHNw
0x39, 0x53, 0x75, 0x46, 0x88, 0x84, 0x3d, 0xe5, 0x50, 0x0b,
0x79, 0x91, 0x33, 0x7f, 0x96, 0xf5, 0x41, 0x71, 0x48, 0xa1,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
// The main (spending) transaction.
0x00, // is_ref = 0 (main)
0x01, 0x00, 0x00, 0x00, // version
0x01, // number of inputs
0x00, 0x19, 0x3c, 0x4d, 0xe2, 0xdb, 0xc9, 0xf9, // previous output
0xca, 0x09, 0xde, 0xb7, 0x41, 0x7a, 0xe4, 0x47,
0x7a, 0x01, 0x72, 0x7a, 0xcc, 0xb8, 0x7a, 0x77,
0x66, 0x99, 0xcb, 0x9f, 0x83, 0x27, 0x32, 0xc8,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee, 0x00, 0x00,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x01, // number of outputs
0x00, 0x46, 0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, // 6 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
// 11MXTrefsj1ZS3Q5e9D6DxGzZKHWALyo9
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** Transaction data to prepend to P2SH test transactions in order to
  * generate a full transaction. The data consists of two input
  * transactions:
  * 4049ff07193b7a021774b043c9e5447a2cf3fac623244753cce6c717d9836594:0 and
  * f26df87eabea87adeef8f7865481590cd9f441400d2acd03e237f1bc5acd8b78:0.
  */
static const uint8_t p2sh_test_prepend[] = {
// The first input transaction.
0x01, // is_ref = 1 (input)
0x00, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x02, // number of inputs
0x1b, 0x45, 0xd2, 0x95, 0x0f, 0x16, 0x79, 0x36, // previous output
0x07, 0x3f, 0xa9, 0x8b, 0x6a, 0xe5, 0x0e, 0x05,
0x0b, 0xab, 0xf0, 0x9c, 0x02, 0x6e, 0xd7, 0x18,
0x4a, 0x88, 0xc5, 0x8f, 0x73, 0x83, 0x7b, 0x8b,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6c, // script length
0x49, // 73 bytes of data follows
0x30, 0x46, 0x02, 0x21, 0x00, 0xf0, 0x17, 0x02, 0x70, 0xa3, 0x2c, 0xd5, 0x69,
0x14, 0x25, 0x76, 0x78, 0x94, 0xad, 0xd5, 0x11, 0x8f, 0xe8, 0x65, 0xaf, 0xb2,
0xa4, 0x38, 0x90, 0xfd, 0xc4, 0xbd, 0xe9, 0xe2, 0xcf, 0x2a, 0xee, 0x02, 0x21,
0x00, 0xe7, 0xc9, 0x65, 0xcd, 0x70, 0xbf, 0x54, 0x78, 0x16, 0xbd, 0x23, 0x80,
0xfe, 0xde, 0x18, 0x05, 0x92, 0x89, 0xd2, 0xe4, 0x09, 0x33, 0x8d, 0xe9, 0x13,
0x81, 0x02, 0x37, 0xd3, 0xbf, 0xf6, 0x1a, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x04, 0x21, 0x11, 0x7b, 0x41, 0x0a, 0x65, 0x5b, 0x5d, 0x8f, 0xc9, 0x4a,
0x6f, 0x3d, 0xd6, 0xd4, 0x3d, 0x12, 0x97, 0x39, 0xbd, 0x9d, 0x96, 0x0e, 0x40,
0x89, 0x4d, 0x29, 0xf2, 0x1c, 0x60, 0x30,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, 0xfa, 0xee, 0x8e, 0x09, 0x6a, 0x0a, 0x62, // previous output
0x66, 0xcc, 0x9d, 0xa7, 0x2f, 0xbc, 0xaa, 0xc1,
0x12, 0xc8, 0x07, 0x9c, 0x48, 0xec, 0x14, 0xa5,
0x8e, 0x49, 0xfa, 0x47, 0x71, 0x02, 0x23, 0xbe,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6c, // script length
0x49, // 73 bytes of data follows
0x30, 0x46, 0x02, 0x21, 0x00, 0xb5, 0xe3, 0x32, 0x67, 0x0c, 0x7c, 0xd6, 0x77,
0x96, 0xba, 0xec, 0xfe, 0x24, 0x34, 0x7f, 0x2c, 0x2e, 0xb6, 0xaa, 0xc9, 0x44,
0x77, 0xe9, 0x02, 0x71, 0xb1, 0xfe, 0xed, 0x58, 0xed, 0xff, 0xe1, 0x02, 0x21,
0x00, 0x88, 0x94, 0x9f, 0xab, 0x19, 0x2b, 0x03, 0x31, 0x09, 0x3e, 0xd8, 0x04,
0x5a, 0xec, 0x60, 0x32, 0x95, 0xe6, 0xe3, 0x6f, 0x3a, 0x5e, 0x6b, 0xbd, 0x1e,
0xb3, 0x5a, 0x7d, 0xfb, 0x97, 0x57, 0x31, 0x01,
0x21, // 33 bytes of data follows
0x03, 0xa4, 0x24, 0x42, 0xc0, 0xf7, 0xe4, 0xab, 0x02, 0x52, 0x8f, 0xf5, 0x1c,
0x64, 0xb7, 0x28, 0x82, 0x85, 0x96, 0xc4, 0x76, 0x73, 0xa6, 0x5b, 0xf0, 0x2a,
0x1a, 0x98, 0xd7, 0x44, 0x61, 0xe6, 0x96,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xc7, 0x7d, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01080775 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0x7c, 0x9b, 0x57, 0xeb, 0x83, 0x41, 0x3f, 0x83, 0x94, 0x85,
0x32, 0x43, 0x98, 0xa9, 0xe7, 0x29, 0x9f, 0x7a, 0x28, 0xb9,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x80, 0x1f, 0x9f, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.10428288 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0x6f, 0x96, 0x60, 0xe4, 0x22, 0xa9, 0xc1, 0x34, 0x31, 0x3f,
0x85, 0x8b, 0x43, 0xdf, 0x75, 0xd3, 0x80, 0x57, 0x3e, 0x3f,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
// The second input transaction.
0x01, // is_ref = 1 (input)
0x00, 0x00, 0x00, 0x00, // output number to examine
0x01, 0x00, 0x00, 0x00, // version
0x05, // number of inputs
0xd0, 0x13, 0x06, 0x79, 0xab, 0x57, 0xb8, 0xcf, // previous output
0xe7, 0x43, 0xd3, 0x1a, 0xd0, 0xd7, 0x3c, 0x9e,
0x76, 0x74, 0x09, 0xdd, 0x98, 0xe5, 0x3f, 0x70,
0x1a, 0x86, 0xe8, 0x77, 0xa1, 0x77, 0x53, 0x15,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6a, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x1c, 0x5e, 0x1e, 0xfd, 0xc9, 0x12, 0x5c, 0x8b, 0x65,
0x9a, 0xf2, 0xe9, 0xcc, 0x64, 0x62, 0xee, 0x19, 0xaa, 0xb1, 0xf4, 0x2e, 0x49,
0x48, 0xf0, 0xc4, 0xb0, 0x5e, 0x30, 0x9d, 0x6c, 0x1f, 0xa8, 0x02, 0x20, 0x6b,
0x9e, 0xc9, 0x26, 0xf3, 0x57, 0x31, 0x77, 0x37, 0x3b, 0xa0, 0x27, 0x26, 0xee,
0xa4, 0x12, 0x90, 0xd8, 0xd7, 0xb7, 0x39, 0xb5, 0x22, 0x4f, 0x6c, 0xc1, 0xa0,
0x04, 0xbd, 0x13, 0xdd, 0xac, 0x01,
0x21, // 33 bytes of data follows
0x03, 0xf1, 0x51, 0xc4, 0xb7, 0x78, 0xff, 0x27, 0x13, 0xfe, 0x8a, 0x32, 0x2b,
0x52, 0xe2, 0xf1, 0xcc, 0x8a, 0xa0, 0x1e, 0x94, 0xb9, 0xc0, 0x8e, 0x2a, 0xbe,
0x17, 0xc9, 0x9d, 0x23, 0x32, 0x1d, 0x27,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0xb3, 0x42, 0x00, 0x15, 0x23, 0x26, 0x1d, 0x88, // previous output
0x4d, 0xd7, 0xde, 0x00, 0x39, 0x8d, 0x3b, 0xf9,
0x8e, 0x9e, 0x6e, 0xf8, 0x7c, 0xe0, 0xc3, 0x3e,
0x3d, 0xc6, 0xbe, 0x8f, 0x29, 0x7e, 0xf8, 0x7e,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6c, // script length
0x49, // 73 bytes of data follows
0x30, 0x46, 0x02, 0x21, 0x00, 0xe2, 0xb0, 0xfd, 0x5b, 0x1b, 0xdf, 0x48, 0xa6,
0xa4, 0xdb, 0x49, 0x62, 0xae, 0x43, 0x74, 0xde, 0xae, 0x9e, 0x3e, 0xb0, 0xd9,
0x47, 0xe9, 0x55, 0x26, 0x93, 0xb9, 0xfb, 0x7c, 0xf5, 0x48, 0xbe, 0x02, 0x21,
0x00, 0xba, 0x72, 0xc9, 0x3a, 0x1a, 0x96, 0x6c, 0x45, 0xec, 0x47, 0x92, 0x6e,
0x8d, 0x56, 0xde, 0xd6, 0x51, 0xad, 0x3d, 0xbd, 0x0b, 0x33, 0xa0, 0x24, 0x1d,
0x83, 0xed, 0x8d, 0x1d, 0x95, 0xce, 0x80, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x2f, 0x09, 0xc7, 0x82, 0xd7, 0xd2, 0x17, 0xff, 0x81, 0xb6, 0xde, 0x5c,
0x9d, 0x16, 0x50, 0xf8, 0x51, 0x4a, 0x38, 0xb0, 0xf5, 0x1f, 0x3c, 0xc7, 0xb0,
0x52, 0x7a, 0x2f, 0x83, 0xac, 0x6f, 0xeb,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x8e, 0xde, 0xa0, 0x30, 0xe4, 0x29, 0x30, 0x9e, // previous output
0x1d, 0xa3, 0x7c, 0x01, 0x61, 0xe3, 0xea, 0xa4,
0xc9, 0x45, 0x8c, 0x09, 0x1b, 0x4d, 0xdd, 0x2e,
0xdd, 0x38, 0x12, 0x0c, 0x19, 0x7f, 0x23, 0x7d,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6b, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x20, 0x56, 0x4d, 0xd3, 0x29, 0x48, 0x98, 0xa3, 0x0b, 0x58,
0x6f, 0xdf, 0x3d, 0xbb, 0x3d, 0x6f, 0xc2, 0x8f, 0x04, 0x2c, 0x44, 0x19, 0x64,
0xd5, 0x9d, 0xbd, 0xc8, 0x83, 0x3a, 0x05, 0x02, 0xd0, 0x55, 0x02, 0x21, 0x00,
0xd3, 0xb0, 0xf2, 0xd8, 0x4d, 0xf4, 0x7e, 0x75, 0x7e, 0xc6, 0x6c, 0x61, 0x1a,
0x08, 0xaa, 0x55, 0x7d, 0xf5, 0x13, 0xd6, 0xa5, 0x66, 0xf9, 0xa3, 0x90, 0xdf,
0xe4, 0x09, 0x8a, 0xcd, 0x7c, 0xa1, 0x01,
0x21, // 33 bytes of data follows
0x02, 0x5f, 0x32, 0x2c, 0x25, 0x65, 0x10, 0xeb, 0x87, 0x62, 0xb5, 0x6d, 0xe5,
0xe4, 0x88, 0x04, 0x2b, 0xec, 0x08, 0x05, 0x44, 0x19, 0x59, 0x96, 0x9a, 0x2f,
0xd3, 0x94, 0xb8, 0x2b, 0x35, 0x97, 0xca,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x65, 0xe0, 0x2f, 0xe9, 0x17, 0xb7, 0xcd, 0x2f, // previous output
0xaf, 0x70, 0xfa, 0x29, 0xb9, 0xe4, 0x07, 0xc1,
0xad, 0x17, 0xa4, 0x27, 0x39, 0xcd, 0x3f, 0xda,
0x82, 0xd8, 0x8d, 0x99, 0x7f, 0x13, 0xda, 0x05,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6c, // script length
0x49, // 73 bytes of data follows
0x30, 0x46, 0x02, 0x21, 0x00, 0xe1, 0x47, 0x23, 0xba, 0xb5, 0x04, 0x13, 0xd1,
0x13, 0x88, 0xcd, 0x16, 0x21, 0x57, 0xb6, 0x39, 0x98, 0xe4, 0x02, 0xac, 0xee,
0xfc, 0x7e, 0x68, 0x34, 0xf3, 0x72, 0x83, 0x9c, 0xf8, 0x4c, 0x04, 0x02, 0x21,
0x00, 0x99, 0xf2, 0x49, 0xf1, 0x0f, 0xea, 0xe2, 0x0f, 0x5b, 0x24, 0x0d, 0xc3,
0x5f, 0xfa, 0x30, 0x81, 0x11, 0xd7, 0x18, 0x3e, 0x5a, 0x74, 0x86, 0xf0, 0xb9,
0x03, 0x72, 0xc0, 0x91, 0x14, 0xf7, 0xe8, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x49, 0xb5, 0x6e, 0x77, 0x33, 0xaa, 0x5f, 0x4f, 0xaa, 0x86, 0xdc, 0xa2,
0xe9, 0x28, 0xba, 0x6c, 0x83, 0x6b, 0x98, 0xff, 0x10, 0xc6, 0x66, 0x24, 0x7a,
0xa6, 0xef, 0xed, 0x66, 0xe4, 0x17, 0xf0,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0xb2, 0x1d, 0x63, 0x9d, 0x27, 0x52, 0xbf, 0xdb, // previous output
0xf7, 0x55, 0x6c, 0x5f, 0x04, 0xab, 0xd5, 0xf6,
0x25, 0x2a, 0xc5, 0xb0, 0x62, 0x01, 0xe5, 0xb5,
0xcc, 0xd1, 0x5a, 0x71, 0xdf, 0x1e, 0xb5, 0x52,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6a, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x61, 0xe0, 0x06, 0x36, 0xa4, 0x4c, 0xf0, 0x9e, 0x95,
0xc5, 0xf1, 0x66, 0x23, 0x99, 0xe2, 0xc4, 0x64, 0x76, 0xc9, 0xf9, 0x6c, 0xe1,
0x4e, 0x7b, 0x7a, 0x05, 0xfc, 0x9c, 0x24, 0xa9, 0x3d, 0x4b, 0x02, 0x20, 0x52,
0xa2, 0xe7, 0x1c, 0x51, 0x1f, 0x96, 0x65, 0x6d, 0xa8, 0x1e, 0x53, 0xb0, 0x5b,
0x46, 0xd6, 0xb3, 0x00, 0xa1, 0x5b, 0x19, 0xd8, 0x58, 0x31, 0x07, 0xa0, 0x32,
0xdd, 0xbf, 0x85, 0xad, 0x27, 0x01,
0x21, // 33 bytes of data follows
0x02, 0xbc, 0xb5, 0x1f, 0x6c, 0x30, 0xf0, 0xf3, 0x89, 0x19, 0xe3, 0x2f, 0x96,
0x11, 0xdf, 0x86, 0x28, 0x8e, 0xa1, 0xc3, 0x74, 0xfe, 0x9d, 0x9a, 0x66, 0x83,
0xd6, 0x8e, 0xbc, 0x41, 0x46, 0xa2, 0x88,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xa8, 0xbb, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01293224 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0x2b, 0x14, 0xcc, 0x3d, 0x20, 0x5b, 0x70, 0x3e, 0xb5, 0x34,
0x8b, 0x7b, 0x64, 0x37, 0x19, 0x62, 0x2b, 0xc3, 0xb8, 0x63,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x7b, 0x72, 0x3f, 0x01, 0x00, 0x00, 0x00, 0x00, // 0.20935291 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xb7, 0x4f, 0xcf, 0x65, 0xf2, 0xa5, 0x2b, 0x5f, 0x96, 0x9e,
0x87, 0x13, 0x40, 0xed, 0xc5, 0x5d, 0x94, 0x61, 0x2f, 0xa8,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x00, 0x00, 0x00, 0x00, // locktime
// The main (spending) transaction.
0x00, // is_ref = 0 (main)
};

/** Transaction fd3a8aa196a06f9c4aab10850dd3f10328fe9db4eee63af554da8baac608ab04
  * from the main blockchain (contained in block 177958). It spends to the P2SH
  * address 3FArYwLzPwRBbh1yN3Fx6tBZ5rZBPdaMPt. */
static const uint8_t good_p2sh_transaction[] = {
0x01, 0x00, 0x00, 0x00, // version
0x02, // number of inputs
0x94, 0x65, 0x83, 0xd9, 0x17, 0xc7, 0xe6, 0xcc, // previous output
0x53, 0x47, 0x24, 0x23, 0xc6, 0xfa, 0xf3, 0x2c,
0x7a, 0x44, 0xe5, 0xc9, 0x43, 0xb0, 0x74, 0x17,
0x02, 0x7a, 0x3b, 0x19, 0x07, 0xff, 0x49, 0x40,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6B, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x21, 0x00, 0x83, 0xc1, 0xce, // signature
0xb7, 0x9d, 0x99, 0xf4, 0x63, 0xe4, 0x4e, 0x36,
0x06, 0x14, 0xa6, 0x99, 0x6f, 0xb5, 0x66, 0xd8,
0x33, 0x04, 0x07, 0x38, 0x59, 0x63, 0xc5, 0xf1,
0xc4, 0xb7, 0x2a, 0x3a, 0x67, 0x02, 0x20, 0x30,
0x9a, 0x36, 0x1b, 0x7f, 0x07, 0xa9, 0x2c, 0xc4,
0x9e, 0x2e, 0x67, 0xeb, 0xb0, 0x78, 0x9c, 0x3e,
0xc4, 0xdb, 0x9d, 0x59, 0x40, 0x7d, 0x6d, 0x6e,
0x10, 0x7e, 0xc4, 0x0a, 0x20, 0x17, 0xb5, 0x01,
0x21, // 33 bytes of data follows
0x02, 0x94, 0x69, 0xf7, 0xc2, 0xf2, 0xcf, 0x66, // compressed public key
0x9d, 0x1c, 0x45, 0x2f, 0x09, 0x93, 0x62, 0x65,
0x8c, 0x94, 0x3f, 0xc6, 0x91, 0x85, 0x69, 0x35,
0x7c, 0x4a, 0xae, 0xec, 0xa2, 0x6e, 0x8b, 0x4b, 0x41,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x78, 0x8b, 0xcd, 0x5a, 0xbc, 0xf1, 0x37, 0xe2, // previous output
0x03, 0xcd, 0x2a, 0x0d, 0x40, 0x41, 0xf4, 0xd9,
0x0c, 0x59, 0x81, 0x54, 0x86, 0xf7, 0xf8, 0xee,
0xad, 0x87, 0xea, 0xab, 0x7e, 0xf8, 0x6d, 0xf2,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6A, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x74, 0xf5, 0xee, 0xa7,
0xe8, 0x57, 0x23, 0xa6, 0x5f, 0x41, 0xb6, 0x9e,
0x65, 0x31, 0x8b, 0xa5, 0x4e, 0xbe, 0xb9, 0x3b,
0x16, 0xfd, 0xd5, 0xd7, 0xc0, 0x9f, 0x7c, 0x7a,
0x3a, 0xcc, 0x01, 0x4f, 0x02, 0x20, 0x4b, 0x03,
0xe7, 0x19, 0x15, 0x22, 0x3b, 0x5b, 0xe7, 0x51,
0xaf, 0x1e, 0x7e, 0xb8, 0x43, 0x0b, 0xf4, 0x9e,
0x4e, 0x2d, 0x53, 0x81, 0x02, 0x2d, 0xc5, 0xe4,
0x3e, 0xae, 0x9b, 0x88, 0x9d, 0x9c, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x55, 0xaf, 0x8c, 0x21, 0x9b, 0xb5, 0x89,
0x5f, 0x4c, 0x1a, 0x57, 0x41, 0xd8, 0x69, 0x34,
0xf0, 0x25, 0x50, 0x46, 0x25, 0xa8, 0xb4, 0x27,
0xc9, 0xa5, 0x71, 0xab, 0xb9, 0xce, 0x89, 0x24, 0x20,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xdf, 0x33, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01323999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xbe, 0xc4, 0x63, 0x34, 0x0d, 0x50, 0xf3, 0x8e, 0x9a, 0xbc,
0x4f, 0x88, 0x79, 0xf8, 0x1f, 0x25, 0x5b, 0xa7, 0xb1, 0x3c,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x42, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01 BTC
0x17, // script length
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0x93, 0xdd, 0x75, 0x55, 0x88, 0x93, 0xd9, 0x7c, 0x53, 0x00,
0x5f, 0x6b, 0x63, 0xb9, 0xe4, 0x00, 0x54, 0x01, 0xa9, 0x31,
0x87, // OP_EQUAL
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** This is #good_p2sh_transaction, but with a non-standard output script
  * which is almost a P2SH output script. */
static const uint8_t nonstandard_p2sh_transaction1[] = {
0x01, 0x00, 0x00, 0x00, // version
0x02, // number of inputs
0x94, 0x65, 0x83, 0xd9, 0x17, 0xc7, 0xe6, 0xcc, // previous output
0x53, 0x47, 0x24, 0x23, 0xc6, 0xfa, 0xf3, 0x2c,
0x7a, 0x44, 0xe5, 0xc9, 0x43, 0xb0, 0x74, 0x17,
0x02, 0x7a, 0x3b, 0x19, 0x07, 0xff, 0x49, 0x40,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6B, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x21, 0x00, 0x83, 0xc1, 0xce, // signature
0xb7, 0x9d, 0x99, 0xf4, 0x63, 0xe4, 0x4e, 0x36,
0x06, 0x14, 0xa6, 0x99, 0x6f, 0xb5, 0x66, 0xd8,
0x33, 0x04, 0x07, 0x38, 0x59, 0x63, 0xc5, 0xf1,
0xc4, 0xb7, 0x2a, 0x3a, 0x67, 0x02, 0x20, 0x30,
0x9a, 0x36, 0x1b, 0x7f, 0x07, 0xa9, 0x2c, 0xc4,
0x9e, 0x2e, 0x67, 0xeb, 0xb0, 0x78, 0x9c, 0x3e,
0xc4, 0xdb, 0x9d, 0x59, 0x40, 0x7d, 0x6d, 0x6e,
0x10, 0x7e, 0xc4, 0x0a, 0x20, 0x17, 0xb5, 0x01,
0x21, // 33 bytes of data follows
0x02, 0x94, 0x69, 0xf7, 0xc2, 0xf2, 0xcf, 0x66, // compressed public key
0x9d, 0x1c, 0x45, 0x2f, 0x09, 0x93, 0x62, 0x65,
0x8c, 0x94, 0x3f, 0xc6, 0x91, 0x85, 0x69, 0x35,
0x7c, 0x4a, 0xae, 0xec, 0xa2, 0x6e, 0x8b, 0x4b, 0x41,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x78, 0x8b, 0xcd, 0x5a, 0xbc, 0xf1, 0x37, 0xe2, // previous output
0x03, 0xcd, 0x2a, 0x0d, 0x40, 0x41, 0xf4, 0xd9,
0x0c, 0x59, 0x81, 0x54, 0x86, 0xf7, 0xf8, 0xee,
0xad, 0x87, 0xea, 0xab, 0x7e, 0xf8, 0x6d, 0xf2,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6A, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x74, 0xf5, 0xee, 0xa7,
0xe8, 0x57, 0x23, 0xa6, 0x5f, 0x41, 0xb6, 0x9e,
0x65, 0x31, 0x8b, 0xa5, 0x4e, 0xbe, 0xb9, 0x3b,
0x16, 0xfd, 0xd5, 0xd7, 0xc0, 0x9f, 0x7c, 0x7a,
0x3a, 0xcc, 0x01, 0x4f, 0x02, 0x20, 0x4b, 0x03,
0xe7, 0x19, 0x15, 0x22, 0x3b, 0x5b, 0xe7, 0x51,
0xaf, 0x1e, 0x7e, 0xb8, 0x43, 0x0b, 0xf4, 0x9e,
0x4e, 0x2d, 0x53, 0x81, 0x02, 0x2d, 0xc5, 0xe4,
0x3e, 0xae, 0x9b, 0x88, 0x9d, 0x9c, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x55, 0xaf, 0x8c, 0x21, 0x9b, 0xb5, 0x89,
0x5f, 0x4c, 0x1a, 0x57, 0x41, 0xd8, 0x69, 0x34,
0xf0, 0x25, 0x50, 0x46, 0x25, 0xa8, 0xb4, 0x27,
0xc9, 0xa5, 0x71, 0xab, 0xb9, 0xce, 0x89, 0x24, 0x20,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xdf, 0x33, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01323999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xbe, 0xc4, 0x63, 0x34, 0x0d, 0x50, 0xf3, 0x8e, 0x9a, 0xbc,
0x4f, 0x88, 0x79, 0xf8, 0x1f, 0x25, 0x5b, 0xa7, 0xb1, 0x3c,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x42, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01 BTC
0x16, // script length
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0x93, 0xdd, 0x75, 0x55, 0x88, 0x93, 0xd9, 0x7c, 0x53, 0x00,
0x5f, 0x6b, 0x63, 0xb9, 0xe4, 0x00, 0x54, 0x01, 0xa9, 0x31,
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** This is #good_p2sh_transaction, but with a non-standard output script
  * which is almost a P2SH output script. */
static const uint8_t nonstandard_p2sh_transaction2[] = {
0x01, 0x00, 0x00, 0x00, // version
0x02, // number of inputs
0x94, 0x65, 0x83, 0xd9, 0x17, 0xc7, 0xe6, 0xcc, // previous output
0x53, 0x47, 0x24, 0x23, 0xc6, 0xfa, 0xf3, 0x2c,
0x7a, 0x44, 0xe5, 0xc9, 0x43, 0xb0, 0x74, 0x17,
0x02, 0x7a, 0x3b, 0x19, 0x07, 0xff, 0x49, 0x40,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6B, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x21, 0x00, 0x83, 0xc1, 0xce, // signature
0xb7, 0x9d, 0x99, 0xf4, 0x63, 0xe4, 0x4e, 0x36,
0x06, 0x14, 0xa6, 0x99, 0x6f, 0xb5, 0x66, 0xd8,
0x33, 0x04, 0x07, 0x38, 0x59, 0x63, 0xc5, 0xf1,
0xc4, 0xb7, 0x2a, 0x3a, 0x67, 0x02, 0x20, 0x30,
0x9a, 0x36, 0x1b, 0x7f, 0x07, 0xa9, 0x2c, 0xc4,
0x9e, 0x2e, 0x67, 0xeb, 0xb0, 0x78, 0x9c, 0x3e,
0xc4, 0xdb, 0x9d, 0x59, 0x40, 0x7d, 0x6d, 0x6e,
0x10, 0x7e, 0xc4, 0x0a, 0x20, 0x17, 0xb5, 0x01,
0x21, // 33 bytes of data follows
0x02, 0x94, 0x69, 0xf7, 0xc2, 0xf2, 0xcf, 0x66, // compressed public key
0x9d, 0x1c, 0x45, 0x2f, 0x09, 0x93, 0x62, 0x65,
0x8c, 0x94, 0x3f, 0xc6, 0x91, 0x85, 0x69, 0x35,
0x7c, 0x4a, 0xae, 0xec, 0xa2, 0x6e, 0x8b, 0x4b, 0x41,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x78, 0x8b, 0xcd, 0x5a, 0xbc, 0xf1, 0x37, 0xe2, // previous output
0x03, 0xcd, 0x2a, 0x0d, 0x40, 0x41, 0xf4, 0xd9,
0x0c, 0x59, 0x81, 0x54, 0x86, 0xf7, 0xf8, 0xee,
0xad, 0x87, 0xea, 0xab, 0x7e, 0xf8, 0x6d, 0xf2,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6A, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x74, 0xf5, 0xee, 0xa7,
0xe8, 0x57, 0x23, 0xa6, 0x5f, 0x41, 0xb6, 0x9e,
0x65, 0x31, 0x8b, 0xa5, 0x4e, 0xbe, 0xb9, 0x3b,
0x16, 0xfd, 0xd5, 0xd7, 0xc0, 0x9f, 0x7c, 0x7a,
0x3a, 0xcc, 0x01, 0x4f, 0x02, 0x20, 0x4b, 0x03,
0xe7, 0x19, 0x15, 0x22, 0x3b, 0x5b, 0xe7, 0x51,
0xaf, 0x1e, 0x7e, 0xb8, 0x43, 0x0b, 0xf4, 0x9e,
0x4e, 0x2d, 0x53, 0x81, 0x02, 0x2d, 0xc5, 0xe4,
0x3e, 0xae, 0x9b, 0x88, 0x9d, 0x9c, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x55, 0xaf, 0x8c, 0x21, 0x9b, 0xb5, 0x89,
0x5f, 0x4c, 0x1a, 0x57, 0x41, 0xd8, 0x69, 0x34,
0xf0, 0x25, 0x50, 0x46, 0x25, 0xa8, 0xb4, 0x27,
0xc9, 0xa5, 0x71, 0xab, 0xb9, 0xce, 0x89, 0x24, 0x20,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xdf, 0x33, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01323999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xbe, 0xc4, 0x63, 0x34, 0x0d, 0x50, 0xf3, 0x8e, 0x9a, 0xbc,
0x4f, 0x88, 0x79, 0xf8, 0x1f, 0x25, 0x5b, 0xa7, 0xb1, 0x3c,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x42, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01 BTC
0x16, // script length
0x14, // 20 bytes of data follows
0x93, 0xdd, 0x75, 0x55, 0x88, 0x93, 0xd9, 0x7c, 0x53, 0x00,
0x5f, 0x6b, 0x63, 0xb9, 0xe4, 0x00, 0x54, 0x01, 0xa9, 0x31,
0x87, // OP_EQUAL
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** This is #good_p2sh_transaction, but with a non-standard output script
  * which is almost a P2SH output script. */
static const uint8_t nonstandard_p2sh_transaction3[] = {
0x01, 0x00, 0x00, 0x00, // version
0x02, // number of inputs
0x94, 0x65, 0x83, 0xd9, 0x17, 0xc7, 0xe6, 0xcc, // previous output
0x53, 0x47, 0x24, 0x23, 0xc6, 0xfa, 0xf3, 0x2c,
0x7a, 0x44, 0xe5, 0xc9, 0x43, 0xb0, 0x74, 0x17,
0x02, 0x7a, 0x3b, 0x19, 0x07, 0xff, 0x49, 0x40,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6B, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x21, 0x00, 0x83, 0xc1, 0xce, // signature
0xb7, 0x9d, 0x99, 0xf4, 0x63, 0xe4, 0x4e, 0x36,
0x06, 0x14, 0xa6, 0x99, 0x6f, 0xb5, 0x66, 0xd8,
0x33, 0x04, 0x07, 0x38, 0x59, 0x63, 0xc5, 0xf1,
0xc4, 0xb7, 0x2a, 0x3a, 0x67, 0x02, 0x20, 0x30,
0x9a, 0x36, 0x1b, 0x7f, 0x07, 0xa9, 0x2c, 0xc4,
0x9e, 0x2e, 0x67, 0xeb, 0xb0, 0x78, 0x9c, 0x3e,
0xc4, 0xdb, 0x9d, 0x59, 0x40, 0x7d, 0x6d, 0x6e,
0x10, 0x7e, 0xc4, 0x0a, 0x20, 0x17, 0xb5, 0x01,
0x21, // 33 bytes of data follows
0x02, 0x94, 0x69, 0xf7, 0xc2, 0xf2, 0xcf, 0x66, // compressed public key
0x9d, 0x1c, 0x45, 0x2f, 0x09, 0x93, 0x62, 0x65,
0x8c, 0x94, 0x3f, 0xc6, 0x91, 0x85, 0x69, 0x35,
0x7c, 0x4a, 0xae, 0xec, 0xa2, 0x6e, 0x8b, 0x4b, 0x41,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x78, 0x8b, 0xcd, 0x5a, 0xbc, 0xf1, 0x37, 0xe2, // previous output
0x03, 0xcd, 0x2a, 0x0d, 0x40, 0x41, 0xf4, 0xd9,
0x0c, 0x59, 0x81, 0x54, 0x86, 0xf7, 0xf8, 0xee,
0xad, 0x87, 0xea, 0xab, 0x7e, 0xf8, 0x6d, 0xf2,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6A, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x74, 0xf5, 0xee, 0xa7,
0xe8, 0x57, 0x23, 0xa6, 0x5f, 0x41, 0xb6, 0x9e,
0x65, 0x31, 0x8b, 0xa5, 0x4e, 0xbe, 0xb9, 0x3b,
0x16, 0xfd, 0xd5, 0xd7, 0xc0, 0x9f, 0x7c, 0x7a,
0x3a, 0xcc, 0x01, 0x4f, 0x02, 0x20, 0x4b, 0x03,
0xe7, 0x19, 0x15, 0x22, 0x3b, 0x5b, 0xe7, 0x51,
0xaf, 0x1e, 0x7e, 0xb8, 0x43, 0x0b, 0xf4, 0x9e,
0x4e, 0x2d, 0x53, 0x81, 0x02, 0x2d, 0xc5, 0xe4,
0x3e, 0xae, 0x9b, 0x88, 0x9d, 0x9c, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x55, 0xaf, 0x8c, 0x21, 0x9b, 0xb5, 0x89,
0x5f, 0x4c, 0x1a, 0x57, 0x41, 0xd8, 0x69, 0x34,
0xf0, 0x25, 0x50, 0x46, 0x25, 0xa8, 0xb4, 0x27,
0xc9, 0xa5, 0x71, 0xab, 0xb9, 0xce, 0x89, 0x24, 0x20,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xdf, 0x33, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01323999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xbe, 0xc4, 0x63, 0x34, 0x0d, 0x50, 0xf3, 0x8e, 0x9a, 0xbc,
0x4f, 0x88, 0x79, 0xf8, 0x1f, 0x25, 0x5b, 0xa7, 0xb1, 0x3c,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x42, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01 BTC
0x19, // script length
0xA9, // OP_HASH160
0x16, // 22 bytes of data follows
0x93, 0xdd, 0x75, 0x55, 0x88, 0x93, 0xd9, 0x7c, 0x53, 0x00,
0x5f, 0x6b, 0x63, 0xb9, 0xe4, 0x00, 0x54, 0x01, 0xa9, 0x31, 0xff, 0xff,
0x87, // OP_EQUAL
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** This is #good_p2sh_transaction, but with a non-standard output script
  * which is almost a P2SH output script. */
static const uint8_t nonstandard_p2sh_transaction4[] = {
0x01, 0x00, 0x00, 0x00, // version
0x02, // number of inputs
0x94, 0x65, 0x83, 0xd9, 0x17, 0xc7, 0xe6, 0xcc, // previous output
0x53, 0x47, 0x24, 0x23, 0xc6, 0xfa, 0xf3, 0x2c,
0x7a, 0x44, 0xe5, 0xc9, 0x43, 0xb0, 0x74, 0x17,
0x02, 0x7a, 0x3b, 0x19, 0x07, 0xff, 0x49, 0x40,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6B, // script length
0x48, // 72 bytes of data follows
0x30, 0x45, 0x02, 0x21, 0x00, 0x83, 0xc1, 0xce, // signature
0xb7, 0x9d, 0x99, 0xf4, 0x63, 0xe4, 0x4e, 0x36,
0x06, 0x14, 0xa6, 0x99, 0x6f, 0xb5, 0x66, 0xd8,
0x33, 0x04, 0x07, 0x38, 0x59, 0x63, 0xc5, 0xf1,
0xc4, 0xb7, 0x2a, 0x3a, 0x67, 0x02, 0x20, 0x30,
0x9a, 0x36, 0x1b, 0x7f, 0x07, 0xa9, 0x2c, 0xc4,
0x9e, 0x2e, 0x67, 0xeb, 0xb0, 0x78, 0x9c, 0x3e,
0xc4, 0xdb, 0x9d, 0x59, 0x40, 0x7d, 0x6d, 0x6e,
0x10, 0x7e, 0xc4, 0x0a, 0x20, 0x17, 0xb5, 0x01,
0x21, // 33 bytes of data follows
0x02, 0x94, 0x69, 0xf7, 0xc2, 0xf2, 0xcf, 0x66, // compressed public key
0x9d, 0x1c, 0x45, 0x2f, 0x09, 0x93, 0x62, 0x65,
0x8c, 0x94, 0x3f, 0xc6, 0x91, 0x85, 0x69, 0x35,
0x7c, 0x4a, 0xae, 0xec, 0xa2, 0x6e, 0x8b, 0x4b, 0x41,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x78, 0x8b, 0xcd, 0x5a, 0xbc, 0xf1, 0x37, 0xe2, // previous output
0x03, 0xcd, 0x2a, 0x0d, 0x40, 0x41, 0xf4, 0xd9,
0x0c, 0x59, 0x81, 0x54, 0x86, 0xf7, 0xf8, 0xee,
0xad, 0x87, 0xea, 0xab, 0x7e, 0xf8, 0x6d, 0xf2,
0x00, 0x00, 0x00, 0x00, // number in previous output
0x6A, // script length
0x47, // 71 bytes of data follows
0x30, 0x44, 0x02, 0x20, 0x74, 0xf5, 0xee, 0xa7,
0xe8, 0x57, 0x23, 0xa6, 0x5f, 0x41, 0xb6, 0x9e,
0x65, 0x31, 0x8b, 0xa5, 0x4e, 0xbe, 0xb9, 0x3b,
0x16, 0xfd, 0xd5, 0xd7, 0xc0, 0x9f, 0x7c, 0x7a,
0x3a, 0xcc, 0x01, 0x4f, 0x02, 0x20, 0x4b, 0x03,
0xe7, 0x19, 0x15, 0x22, 0x3b, 0x5b, 0xe7, 0x51,
0xaf, 0x1e, 0x7e, 0xb8, 0x43, 0x0b, 0xf4, 0x9e,
0x4e, 0x2d, 0x53, 0x81, 0x02, 0x2d, 0xc5, 0xe4,
0x3e, 0xae, 0x9b, 0x88, 0x9d, 0x9c, 0x01,
0x21, // 33 bytes of data follows
0x03, 0x55, 0xaf, 0x8c, 0x21, 0x9b, 0xb5, 0x89,
0x5f, 0x4c, 0x1a, 0x57, 0x41, 0xd8, 0x69, 0x34,
0xf0, 0x25, 0x50, 0x46, 0x25, 0xa8, 0xb4, 0x27,
0xc9, 0xa5, 0x71, 0xab, 0xb9, 0xce, 0x89, 0x24, 0x20,
0xFF, 0xFF, 0xFF, 0xFF, // sequence
0x02, // number of outputs
0xdf, 0x33, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01323999 BTC
0x19, // script length
0x76, // OP_DUP
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0xbe, 0xc4, 0x63, 0x34, 0x0d, 0x50, 0xf3, 0x8e, 0x9a, 0xbc,
0x4f, 0x88, 0x79, 0xf8, 0x1f, 0x25, 0x5b, 0xa7, 0xb1, 0x3c,
0x88, // OP_EQUALVERIFY
0xAC, // OP_CHECKSIG
0x40, 0x42, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, // 0.01 BTC
0x19, // script length
0xA9, // OP_HASH160
0x14, // 20 bytes of data follows
0x93, 0xdd, 0x75, 0x55, 0x88, 0x93, 0xd9, 0x7c, 0x53, 0x00,
0x5f, 0x6b, 0x63, 0xb9, 0xe4, 0x00, 0x54, 0x01, 0xa9, 0x31, 0xff, 0xff,
0x87, // OP_EQUAL
0x00, 0x00, 0x00, 0x00, // locktime
0x01, 0x00, 0x00, 0x00 // hashtype
};

/** Private key to sign test transaction with. */
static const uint8_t private_key[] = {
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee,
0xde, 0xad, 0xbe, 0xef, 0xc0, 0xff, 0xee, 0xee};

/** Stores one test case for encapsulateSignature(). */
struct EncapsulateSignatureTestStruct
{
	uint8_t r[32];
	uint8_t s[32];
	uint8_t expected_length;
	uint8_t expected_signature[MAX_SIGNATURE_LENGTH];
};

/** These test cases were constructed manually. */
const struct EncapsulateSignatureTestStruct encapsulate_tests[] = {
{ // All zeroes for r and s. This produces a minimum length signature.
{ // r
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
{ // s
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
9, // expected_length
// expected_signature
{0x30, 0x06, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x01}},

{ // r and s < 128. This produces a minimum length signature.
{ // r
0x7f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
{ // s
0x7f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
9, // expected_length
// expected_signature
{0x30, 0x06, 0x02, 0x01, 0x7f, 0x02, 0x01, 0x7f, 0x01}},

{ // r is 1, s is 0.
{ // r
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
{ // s
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
9, // expected_length
// expected_signature
{0x30, 0x06, 0x02, 0x01, 0x01, 0x02, 0x01, 0x00, 0x01}},

{ // r is 0x80, s is 0. This tests zero-padding of r.
{ // r
0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
{ // s
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
10, // expected_length
// expected_signature
{0x30, 0x07, 0x02, 0x02, 0x00, 0x80, 0x02, 0x01, 0x00, 0x01}},

{ // r is 0, s is 0xff. This tests zero-padding of s.
{ // r
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
{ // s
0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
10, // expected_length
// expected_signature
{0x30, 0x07, 0x02, 0x01, 0x00, 0x02, 0x02, 0x00, 0xff, 0x01}},

{ // r is 0, s is 2 ^ 256 - 1. This tests whether the leading zero is kept.
{ // r
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
41, // expected_length
// expected_signature
{0x30, 0x26, 0x02, 0x01, 0x00, 0x02, 0x21, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}},

{ // Both r and s are 2 ^ 256 - 1. This results in a maximum length signature.
{ // r
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
73, // expected_length
// expected_signature
{0x30, 0x46, 0x02, 0x21, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x02, 0x21, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}},

{ // r is 2 ^ 256 - 1, s is 2 ^ 255 - 1. s shouldn't have a leading zero.
{ // r
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
72, // expected_length
// expected_signature
{0x30, 0x45, 0x02, 0x21, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x02, 0x20,
0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}},

{ // r is 2 ^ 255 - 1, s is 2 ^ 256 - 1. r shouldn't have a leading zero.
{ // r
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
72, // expected_length
// expected_signature
{0x30, 0x45, 0x02, 0x20,
0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x02, 0x21, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}},

{ // Both r and s are 2 ^ 255 - 1. Both shouldn't have a leading zero.
{ // r
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
71, // expected_length
// expected_signature
{0x30, 0x44, 0x02, 0x20,
0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x02, 0x20,
0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}},

{ // Both r and s are between 0 and 2 ^ 255 - 1. This tests zero removal.
{ // r
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0x12, 0x00, 0x00},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00},
66, // expected_length
// expected_signature
{0x30, 0x3f, 0x02, 0x1e,
0x12, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x02, 0x1d,
0x00, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}},

{ // r and s are swapped compared to previous test.
{ // r
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00},
{ // s
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0x12, 0x00, 0x00},
66, // expected_length
// expected_signature
{0x30, 0x3f, 0x02, 0x1d,
0x00, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x02, 0x1e,
0x12, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01}}
};

/** After each call to generateTestTransaction(), this will contain the offset
  * within the "full" transaction where the main transaction begins. */
static uint32_t main_offset;

/** Generate a test transaction with the specified number of inputs and
  * outputs. This generates a "full" transaction, which all (referenced)
  * input transactions followed by the main (spending) transaction.
  * The structure of transactions was obtained from
  * https://en.bitcoin.it/wiki/Protocol_specification on 11-June-2012.
  * \param out_length The length of the generated transaction will be written
  *                   here.
  * \param num_inputs The number of inputs to include in the transaction.
  * \param num_outputs The number of outputs to include in the transaction.
  * \return A pointer to a byte array containing the transaction data. This
  *         array must eventually be freed by the caller.
  */
static uint8_t *generateTestTransaction(uint32_t *out_length, uint32_t num_inputs, uint32_t num_outputs)
{
	uint8_t *buffer;
	uint32_t ptr;
	uint32_t i;
	size_t malloc_size;
	uint8_t temp[20];
	int j;

	malloc_size = num_inputs * sizeof(one_input);
	malloc_size += num_inputs * (sizeof(good_input_transaction) + 1);
	malloc_size += num_outputs * sizeof(one_output);
	malloc_size += sizeof(good_main_transaction);
	malloc_size += 100; // just to be sure
	buffer = malloc(malloc_size);
	ptr = 0;

	// Write input transactions.
	for (i = 0; i < num_inputs; i++)
	{
		buffer[ptr] = 0x01; // is_ref = 1 (input)
		ptr++;
		memcpy(&(buffer[ptr]), good_input_transaction, sizeof(good_input_transaction));
		ptr += sizeof(good_input_transaction);
	}

	buffer[ptr] = 0x00; // is_ref = 0 (main)
	ptr++;

	// The main transaction begins here.
	main_offset = ptr;

	// Write version.
	writeU32LittleEndian(&(buffer[ptr]), 0x00000001);
	ptr += 4;
	// Write number of inputs.
	if (num_inputs < 0xfd)
	{
		buffer[ptr] = (uint8_t)num_inputs;
		ptr++;
	}
	else if (num_inputs <= 0xffff)
	{
		buffer[ptr] = 0xfd;
		ptr++;
		buffer[ptr] = (uint8_t)num_inputs;
		ptr++;
		buffer[ptr] = (uint8_t)(num_inputs >> 8);
		ptr++;
	}
	else
	{
		buffer[ptr] = 0xfe;
		ptr++;
		writeU32LittleEndian(&(buffer[ptr]), num_inputs);
		ptr += 4;
	}
	// Write inputs.
	for (i = 0; i < num_inputs; i++)
	{
		memcpy(&(buffer[ptr]), one_input, sizeof(one_input));
		ptr += sizeof(one_input);
	}
	// Write number of outputs.
	if (num_outputs < 0xfd)
	{
		buffer[ptr] = (uint8_t)num_outputs;
		ptr++;
	}
	else if (num_outputs <= 0xffff)
	{
		buffer[ptr] = 0xfd;
		ptr++;
		buffer[ptr] = (uint8_t)num_outputs;
		ptr++;
		buffer[ptr] = (uint8_t)(num_outputs >> 8);
		ptr++;
	}
	else
	{
		buffer[ptr] = 0xfe;
		ptr++;
		writeU32LittleEndian(&(buffer[ptr]), num_outputs);
		ptr += 4;
	}
	// Write outputs.
	for (i = 0; i < num_outputs; i++)
	{
		memcpy(&(buffer[ptr]), one_output, sizeof(one_output));
		if (i == 0)
		{
			memcpy(&(buffer[ptr]), output_amount1, sizeof(output_amount1));
			memcpy(&(buffer[ptr + 12]), output_address1, sizeof(output_address1));
		}
		else if (i == 1)
		{
			memcpy(&(buffer[ptr]), output_amount2, sizeof(output_amount2));
			memcpy(&(buffer[ptr + 12]), output_address2, sizeof(output_address2));
		}
		else
		{
			// Use random amount/address.
			memset(temp, 0, 8);
			// Make sure it's small enough that the transaction fee is always
			// positive.
			for (j = 0; j < 2; j++)
			{
				temp[j] = (uint8_t)(rand() & 0xff);
			}
			memcpy(&(buffer[ptr]), temp, 8);
			for (j = 0; j < 20; j++)
			{
				temp[j] = (uint8_t)(rand() & 0xff);
			}
			memcpy(&(buffer[ptr + 12]), temp, 20);
		}
		ptr += sizeof(one_output);
	}
	// Write locktime.
	writeU32LittleEndian(&(buffer[ptr]), 0x00000000);
	ptr += 4;
	// Write hashtype.
	writeU32LittleEndian(&(buffer[ptr]), 0x00000001);
	ptr += 4;
	*out_length = ptr;
	return buffer;
}

/** Check that the number of outputs seen is as expected.
  * \param target The expected number of outputs.
  */
static void checkOutputsSeen(int target)
{
	if (num_outputs_seen != target)
	{
		printf("Expected to see %d outputs, got %d\n", target, num_outputs_seen);
		reportFailure();
	}
	else
	{
		reportSuccess();
	}
}

/** Set the input stream to some transaction data and attempt to parse that
  * transaction.
  * \param buffer The test transaction data. If this is NULL, the input stream
  *               will be set to an infinite stream of zeroes.
  * \param length The length of the transaction, in number of bytes.
  * \param name The test name of the transaction. This is displayed on stdout
  *             if a test fails.
  * \param expected_return The expected return value of parseTransaction().
  */
static void testTransaction(const uint8_t *buffer, uint32_t length, const char *name, TransactionErrors expected_return)
{
	uint8_t sig_hash[32];
	uint8_t transaction_hash[32];
	TransactionErrors r;

	clearOutputsSeen();
	if (buffer == NULL)
	{
		setInfiniteZeroInputStream();
	}
	else
	{
		setTestInputStream(buffer, length);
	}
	r = parseTransaction(sig_hash, transaction_hash, length);
	// Check return value is what is expected.
	if (r != expected_return)
	{
		printf("parseTransaction() returned unexpected value for transaction \"%s\"\n", name);
		printf("Expected: %d, got: %d\n", (int)expected_return, (int)r);
		reportFailure();
	}
	else
	{
		// Then check if all bytes in the transaction were consumed.
		if (!isEndOfTransactionData())
		{
			printf("parseTransaction() didn't eat everything for transaction \"%s\"\n", name);
			reportFailure();
		}
		else
		{
			// Then check that there was no attempt to read past the end of
			// the transaction.
			if (transaction_data_index > transaction_length)
			{
				printf("parseTransaction() read past end for transaction \"%s\"\n", name);
				reportFailure();
			}
			else
			{
				reportSuccess();
			}
		}
	} // end if (r != expected_return)
}

/** This is just like testTransaction(), except this prepends
  * #good_input_transaction (and the is_ref bytes) to the test transaction data.
  * \param buffer See testTransaction().
  * \param length See testTransaction().
  * \param name See testTransaction().
  * \param expected_return See testTransaction().
  */
static void prependGoodInputTestTransaction(const uint8_t *buffer, uint32_t length, const char *name, TransactionErrors expected_return)
{
	uint8_t *new_buffer;
	uint32_t new_length;

	if (length > (0xffffffff - (sizeof(good_input_transaction) + 2)))
	{
		// length + sizeof(good_input_transaction) + 2 will overflow.
		printf("Unexpected fatal error: length too big in prependGoodInputTestTransaction()\n");
		exit(1);
	}
	new_length = length + sizeof(good_input_transaction) + 2;
	new_buffer = malloc(new_length);
	new_buffer[0] = 0x01; // is_ref = 1 (input)
	memcpy(&(new_buffer[1]), good_input_transaction, sizeof(good_input_transaction));
	new_buffer[sizeof(good_input_transaction) + 1] = 0x00; // is_ref = 0 (main)
	memcpy(&(new_buffer[sizeof(good_input_transaction) + 2]), buffer, length);
	testTransaction(new_buffer, new_length, name, expected_return);
	free(new_buffer);
}

/** This is just like testTransaction(), except this prepends
  * #p2sh_test_prepend to the test transaction data.
  * \param buffer See testTransaction().
  * \param length See testTransaction().
  * \param name See testTransaction().
  * \param expected_return See testTransaction().
  */
static void prependGoodP2SHInputsTestTransaction(const uint8_t *buffer, uint32_t length, const char *name, TransactionErrors expected_return)
{
	uint8_t *new_buffer;
	uint32_t new_length;

	if (length > (0xffffffff - sizeof(p2sh_test_prepend)))
	{
		// length + sizeof(p2sh_test_prepend) will overflow.
		printf("Unexpected fatal error: length too big in prependGoodP2SHInputsTestTransaction()\n");
		exit(1);
	}
	new_length = length + sizeof(p2sh_test_prepend);
	new_buffer = malloc(new_length);
	memcpy(new_buffer, p2sh_test_prepend, sizeof(p2sh_test_prepend));
	memcpy(&(new_buffer[sizeof(p2sh_test_prepend)]), buffer, length);
	testTransaction(new_buffer, new_length, name, expected_return);
	free(new_buffer);
}

int main(void)
{
	int i;
	int num_tests;
	char name[1024];
	uint8_t bad_full_transaction[sizeof(good_full_transaction)];
	uint8_t bad_main_transaction[sizeof(good_main_transaction)];
	uint8_t big_amount_buffer[sizeof(big_amount_full_transaction)];
	uint8_t *generated_transaction;
	uint32_t length;
	uint8_t sig_hash[32];
	uint8_t transaction_hash[32];
	uint8_t calculated_sig_hash[32];
	uint8_t calculated_transaction_hash[32];
	uint8_t sig_hash_input_changed[32];
	uint8_t transaction_hash_input_changed[32];
	uint8_t sig_hash_output_changed[32];
	uint8_t transaction_hash_output_changed[32];
	uint8_t signature[MAX_SIGNATURE_LENGTH];
	uint8_t signature_length;
	HashState test_hs;

	initTests(__FILE__);

	initWalletTest();
	initialiseDefaultEntropyPool();

	// Test the transaction parser on some transactions which have invalid
	// lengths.
	testTransaction(good_full_transaction, 0, "blank", TRANSACTION_INVALID_FORMAT);
	testTransaction(NULL, MAX_TRANSACTION_SIZE + 1, "toobig", TRANSACTION_TOO_LARGE);
	// length = 0xffffffff left to end.

	// Test the transaction parser on a known good transaction.
	testTransaction(good_full_transaction, sizeof(good_full_transaction), "good", TRANSACTION_NO_ERROR);

	// Sanity check: prependGoodInputTestTransaction() with the main
	// transaction from  good_full_transaction should produce identical
	// results to the test immediately above.
	prependGoodInputTestTransaction(good_main_transaction, sizeof(good_main_transaction), "good2", TRANSACTION_NO_ERROR);

	// Truncate the good transaction and check that the transaction parser
	// doesn't choke.
	for (i = 0; i < sizeof(good_full_transaction); i++)
	{
		sprintf(name, "truncate%d", i);
		testTransaction(good_full_transaction, (uint32_t)i, name, TRANSACTION_INVALID_FORMAT);
	}

	// Corrupt the version field.
	memcpy(bad_main_transaction, good_main_transaction, sizeof(good_main_transaction));
	writeU32LittleEndian(bad_main_transaction, 0x00000000); // version
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badversion", TRANSACTION_NON_STANDARD);
	writeU32LittleEndian(bad_main_transaction, 0xFFFFFFFF); // version
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badversion2", TRANSACTION_NON_STANDARD);
	writeU32LittleEndian(bad_main_transaction, 0x00000002); // version
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badversion3", TRANSACTION_NON_STANDARD);

	// Say that there are inputs, but don't actually include the inputs.
	prependGoodInputTestTransaction(inputs_removed_transaction, sizeof(inputs_removed_transaction), "noinputs", TRANSACTION_INVALID_FORMAT);
	memcpy(bad_main_transaction, inputs_removed_transaction, sizeof(inputs_removed_transaction));
	bad_main_transaction[4] = 0xfc; // number of inputs
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(inputs_removed_transaction), "noinputs2", TRANSACTION_INVALID_FORMAT);

	// A sanity check: since generateTestTransaction() uses data derived
	// from good_full_transaction, using generateTestTransaction() with
	// num_inputs set to 1 should return a transaction identical to
	// good_full_transaction.
	generated_transaction = generateTestTransaction(&length, 1, 2);
	if (memcmp(generated_transaction, good_full_transaction, length))
	{
		printf("generateTestTransaction() sanity check failed\n");
		exit(1);
	}
	free(generated_transaction);

	// Include the wrong number of inputs.
	generated_transaction = generateTestTransaction(&length, 2, 2);
	generated_transaction[main_offset + 4] = 0x03; // number of inputs (too many)
	testTransaction(generated_transaction, length, "wronginputs", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 7, 2);
	generated_transaction[main_offset + 4] = 0x02; // number of inputs (too few)
	// The transaction parser should return TRANSACTION_INVALID_REFERENCE
	// because the input transaction hashes don't match the input
	// references.
	testTransaction(generated_transaction, length, "wronginputs2", TRANSACTION_INVALID_REFERENCE);
	free(generated_transaction);

	// Include no inputs.
	generated_transaction = generateTestTransaction(&length, 0, 2);
	testTransaction(generated_transaction, length, "noinputs", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);

	// The transaction parser should successfully parse transactions with up
	// to MAX_INPUTS inputs.
	generated_transaction = generateTestTransaction(&length, 1, 2);
	testTransaction(generated_transaction, length, "1input", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 2, 2);
	testTransaction(generated_transaction, length, "2inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	// Try numbers close to varint boundaries...
	generated_transaction = generateTestTransaction(&length, 0xfb, 2);
	testTransaction(generated_transaction, length, "251inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0xfc, 2);
	testTransaction(generated_transaction, length, "252inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0xfd, 2);
	testTransaction(generated_transaction, length, "253inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0xfe, 2);
	testTransaction(generated_transaction, length, "254inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0xff, 2);
	testTransaction(generated_transaction, length, "255inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0x100, 2);
	testTransaction(generated_transaction, length, "256inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0x101, 2);
	testTransaction(generated_transaction, length, "257inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 0x102, 2);
	testTransaction(generated_transaction, length, "258inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, MAX_INPUTS - 2, 2);
	testTransaction(generated_transaction, length, "MAX-2inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, MAX_INPUTS - 1, 2);
	testTransaction(generated_transaction, length, "MAX-1inputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, MAX_INPUTS, 2);
	testTransaction(generated_transaction, length, "MAXinputs", TRANSACTION_NO_ERROR);
	free(generated_transaction);

	// The transaction parser should reject transactions with too many inputs.
	generated_transaction = generateTestTransaction(&length, MAX_INPUTS + 1, 2);
	testTransaction(generated_transaction, length, "MAX+2inputs", TRANSACTION_TOO_MANY_INPUTS);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, MAX_INPUTS + 2, 2);
	testTransaction(generated_transaction, length, "MAX+2inputs", TRANSACTION_TOO_MANY_INPUTS);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 10, 2);
	generated_transaction[main_offset + 4] = 0xfe;
	writeU32LittleEndian(&(generated_transaction[main_offset + 5]), 0xffffffff); // number of inputs
	testTransaction(generated_transaction, length, "stupidinputs", TRANSACTION_TOO_MANY_INPUTS);
	free(generated_transaction);

	// Technically, a blank script is a valid script. The transaction parser
	// doesn't care what the input script is, so it should accept blank
	// scripts.
	prependGoodInputTestTransaction(good_main_transaction_blank_script, sizeof(good_main_transaction_blank_script), "blankscript", TRANSACTION_NO_ERROR);

	// Corrupt the sequence field.
	memcpy(bad_main_transaction, good_main_transaction, sizeof(good_main_transaction));
	writeU32LittleEndian(&(bad_main_transaction[67]), 0x00000000); // sequence
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badsequence", TRANSACTION_NON_STANDARD);
	writeU32LittleEndian(&(bad_main_transaction[67]), 0xFFFFFFFE); // sequence
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badsequence2", TRANSACTION_NON_STANDARD);

	// Say that there are outputs, but don't actually include the outputs.
	testTransaction(outputs_removed_transaction, sizeof(outputs_removed_transaction), "nooutputs", TRANSACTION_INVALID_FORMAT);
	generated_transaction = malloc(sizeof(outputs_removed_transaction));
	memcpy(generated_transaction, outputs_removed_transaction, sizeof(outputs_removed_transaction));
	generated_transaction[335] = 0xfc; // number of outputs
	testTransaction(generated_transaction, sizeof(outputs_removed_transaction), "nooutputs2", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);

	// Include the wrong number of outputs.
	testTransaction(too_many_outputs_transaction, sizeof(too_many_outputs_transaction), "wrongoutputs", TRANSACTION_INVALID_FORMAT);
	generated_transaction = generateTestTransaction(&length, 1, 9);
	generated_transaction[main_offset + 71] = 0x01; // number of outputs (too few)
	// The transaction parser will return TRANSACTION_NON_STANDARD because it
	// interprets the first 4 bytes of one of the outputs as locktime. Those
	// bytes won't be 0x00000000, so it will think the transaction is non
	// standard.
	testTransaction(generated_transaction, length, "wrongoutputs2", TRANSACTION_NON_STANDARD);
	free(generated_transaction);

	// Include no outputs.
	generated_transaction = generateTestTransaction(&length, 1, 0);
	testTransaction(generated_transaction, length, "nooutputs", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);

	// The transaction parser should successfully parse transactions with up
	// to MAX_OUTPUTS outputs.
	generated_transaction = generateTestTransaction(&length, 1, 1);
	testTransaction(generated_transaction, length, "1output", TRANSACTION_NO_ERROR);
	checkOutputsSeen(1);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, 2);
	testTransaction(generated_transaction, length, "2outputs", TRANSACTION_NO_ERROR);
	checkOutputsSeen(2);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, 3);
	testTransaction(generated_transaction, length, "3outputs", TRANSACTION_NO_ERROR);
	checkOutputsSeen(3);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, MAX_OUTPUTS - 2);
	testTransaction(generated_transaction, length, "MAX-2outputs", TRANSACTION_NO_ERROR);
	checkOutputsSeen(MAX_OUTPUTS - 2);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, MAX_OUTPUTS - 1);
	testTransaction(generated_transaction, length, "MAX-1outputs", TRANSACTION_NO_ERROR);
	checkOutputsSeen(MAX_OUTPUTS - 1);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, MAX_OUTPUTS);
	testTransaction(generated_transaction, length, "MAXoutputs", TRANSACTION_NO_ERROR);
	checkOutputsSeen(MAX_OUTPUTS);
	free(generated_transaction);

	// The transaction parser should reject transactions with more than
	// MAX_OUTPUTS outputs.
	generated_transaction = generateTestTransaction(&length, 1, MAX_OUTPUTS + 1);
	testTransaction(generated_transaction, length, "MAX+1output", TRANSACTION_TOO_MANY_OUTPUTS);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, MAX_OUTPUTS + 2);
	testTransaction(generated_transaction, length, "MAX+2outputs", TRANSACTION_TOO_MANY_OUTPUTS);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, MAX_OUTPUTS + 3);
	testTransaction(generated_transaction, length, "MAX+3outputs", TRANSACTION_TOO_MANY_OUTPUTS);
	free(generated_transaction);
	generated_transaction = generateTestTransaction(&length, 1, 20);
	generated_transaction[main_offset + 71] = 0xfe;
	writeU32LittleEndian(&(generated_transaction[main_offset + 72]), 0xffffffff); // number of outputs
	testTransaction(generated_transaction, length, "stupidoutputs", TRANSACTION_TOO_MANY_OUTPUTS);
	free(generated_transaction);

	// Try number of outputs = 2 ^ 64 - 1, just to screw with the varint
	// reader.
	generated_transaction = generateTestTransaction(&length, 1, 20);
	generated_transaction[main_offset + 71] = 0xff;
	writeU32LittleEndian(&(generated_transaction[main_offset + 72]), 0xffffffff); // number of outputs
	writeU32LittleEndian(&(generated_transaction[main_offset + 76]), 0xffffffff); // number of outputs
	// The transaction parser returns TRANSACTION_INVALID_FORMAT because
	// the varint reader can't read uint64_t.
	testTransaction(generated_transaction, length, "stupideroutputs", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);

	// The transaction parser does care about output scripts, so it should
	// reject a blank output script as non-standard.
	prependGoodInputTestTransaction(good_test_transaction_blank_output_script, sizeof(good_test_transaction_blank_output_script), "blankoutput", TRANSACTION_NON_STANDARD);

	// Check that the transaction parser recognises (and rejects) non standard
	// transactions.
	prependGoodInputTestTransaction(non_standard1, sizeof(non_standard1), "non_standard1", TRANSACTION_NON_STANDARD);
	prependGoodInputTestTransaction(non_standard2, sizeof(non_standard2), "non_standard2", TRANSACTION_NON_STANDARD);
	prependGoodInputTestTransaction(non_standard3, sizeof(non_standard3), "non_standard3", TRANSACTION_NON_STANDARD);
	prependGoodInputTestTransaction(non_standard4, sizeof(non_standard4), "non_standard4", TRANSACTION_NON_STANDARD);
	prependGoodInputTestTransaction(non_standard5, sizeof(non_standard5), "non_standard5", TRANSACTION_NON_STANDARD);
	prependGoodInputTestTransaction(non_standard6, sizeof(non_standard6), "non_standard6", TRANSACTION_NON_STANDARD);
	prependGoodInputTestTransaction(non_standard7, sizeof(non_standard7), "non_standard7", TRANSACTION_NON_STANDARD);

	// Try some output amounts near and above max_money.
	memcpy(big_amount_buffer, big_amount_full_transaction, sizeof(big_amount_full_transaction));
	writeU32LittleEndian(&(big_amount_buffer[301]), 0x5A073FFF); // amount (least significant)
	writeU32LittleEndian(&(big_amount_buffer[305]), 0x000775F0); // amount (most significant)
	testTransaction(big_amount_buffer, sizeof(big_amount_full_transaction), "maxmoney-1", TRANSACTION_NO_ERROR);
	writeU32LittleEndian(&(big_amount_buffer[301]), 0x5A074000); // amount (least significant)
	writeU32LittleEndian(&(big_amount_buffer[305]), 0x000775F0); // amount (most significant)
	testTransaction(big_amount_buffer, sizeof(big_amount_full_transaction), "maxmoney", TRANSACTION_NO_ERROR);
	writeU32LittleEndian(&(big_amount_buffer[301]), 0x5A074001); // amount (least significant)
	writeU32LittleEndian(&(big_amount_buffer[305]), 0x000775F0); // amount (most significant)
	testTransaction(big_amount_buffer, sizeof(big_amount_full_transaction), "maxmoney+1", TRANSACTION_INVALID_AMOUNT);
	writeU32LittleEndian(&(big_amount_buffer[301]), 0x5A074000); // amount (least significant)
	writeU32LittleEndian(&(big_amount_buffer[305]), 0x000775F1); // amount (most significant)
	testTransaction(big_amount_buffer, sizeof(big_amount_full_transaction), "biggermoney", TRANSACTION_INVALID_AMOUNT);
	writeU32LittleEndian(&(big_amount_buffer[301]), 0xFFFFFFFF); // amount (least significant)
	writeU32LittleEndian(&(big_amount_buffer[305]), 0xFFFFFFFF); // amount (most significant)
	testTransaction(big_amount_buffer, sizeof(big_amount_full_transaction), "biggestmoney", TRANSACTION_INVALID_AMOUNT);

	// Test the transaction parser on a known good P2SH transaction.
	prependGoodP2SHInputsTestTransaction(good_p2sh_transaction, sizeof(good_p2sh_transaction), "good_p2sh", TRANSACTION_NO_ERROR);

	// Corrupt some of the P2SH output script bytes, making it non-standard.
	generated_transaction = malloc(sizeof(good_p2sh_transaction));
	memcpy(generated_transaction, good_p2sh_transaction, sizeof(good_p2sh_transaction));
	generated_transaction[344] = 0xaa;
	prependGoodP2SHInputsTestTransaction(generated_transaction, sizeof(good_p2sh_transaction), "bad_p2sh1", TRANSACTION_NON_STANDARD);
	memcpy(generated_transaction, good_p2sh_transaction, sizeof(good_p2sh_transaction));
	generated_transaction[345] = 0x15;
	prependGoodP2SHInputsTestTransaction(generated_transaction, sizeof(good_p2sh_transaction), "bad_p2sh2", TRANSACTION_NON_STANDARD);
	memcpy(generated_transaction, good_p2sh_transaction, sizeof(good_p2sh_transaction));
	generated_transaction[366] = 0x88;
	prependGoodP2SHInputsTestTransaction(generated_transaction, sizeof(good_p2sh_transaction), "bad_p2sh3", TRANSACTION_NON_STANDARD);
	free(generated_transaction);
	prependGoodP2SHInputsTestTransaction(nonstandard_p2sh_transaction1, sizeof(nonstandard_p2sh_transaction1), "nonstandard_p2sh_transaction1", TRANSACTION_NON_STANDARD);
	prependGoodP2SHInputsTestTransaction(nonstandard_p2sh_transaction2, sizeof(nonstandard_p2sh_transaction2), "nonstandard_p2sh_transaction2", TRANSACTION_NON_STANDARD);
	prependGoodP2SHInputsTestTransaction(nonstandard_p2sh_transaction3, sizeof(nonstandard_p2sh_transaction3), "nonstandard_p2sh_transaction3", TRANSACTION_NON_STANDARD);
	prependGoodP2SHInputsTestTransaction(nonstandard_p2sh_transaction4, sizeof(nonstandard_p2sh_transaction4), "nonstandard_p2sh_transaction4", TRANSACTION_NON_STANDARD);

	// Truncate the good P2SH transaction and check that the transaction parser
	// doesn't choke.
	for (i = 0; i < sizeof(good_p2sh_transaction); i++)
	{
		sprintf(name, "truncate_p2sh%d", i);
		prependGoodP2SHInputsTestTransaction(good_p2sh_transaction, (uint32_t)i, name, TRANSACTION_INVALID_FORMAT);
	}

	// Corrupt the locktime field.
	memcpy(bad_main_transaction, good_main_transaction, sizeof(good_main_transaction));
	writeU32LittleEndian(&(bad_main_transaction[140]), 0x00000001); // locktime
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badlocktime", TRANSACTION_NON_STANDARD);
	writeU32LittleEndian(&(bad_main_transaction[140]), 0xFFFFFFFF); // locktime
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badlocktime2", TRANSACTION_NON_STANDARD);

	// Corrupt the hashtype field.
	memcpy(bad_main_transaction, good_main_transaction, sizeof(good_main_transaction));
	writeU32LittleEndian(&(bad_main_transaction[144]), 0x00000000); // hashtype
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badhashtype", TRANSACTION_NON_STANDARD);
	writeU32LittleEndian(&(bad_main_transaction[144]), 0xFFFFFFFF); // hashtype
	prependGoodInputTestTransaction(bad_main_transaction, sizeof(good_main_transaction), "badhashtype2", TRANSACTION_NON_STANDARD);

	// Add junk data to the end of a good transaction.
	length = sizeof(good_full_transaction) + 1;
	generated_transaction = malloc(length);
	memcpy(generated_transaction, good_full_transaction, sizeof(good_full_transaction));
	generated_transaction[sizeof(good_full_transaction)] = 0xca;
	testTransaction(generated_transaction, length, "junkatend", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);
	length = sizeof(good_full_transaction) + 65537;
	generated_transaction = malloc(length);
	memcpy(generated_transaction, good_full_transaction, sizeof(good_full_transaction));
	memset(&(generated_transaction[sizeof(good_full_transaction)]), 3, 65537);
	testTransaction(generated_transaction, length, "junkatend2", TRANSACTION_INVALID_FORMAT);
	free(generated_transaction);

	// Check that the signature hash is a double SHA-256 hash of the
	// (main) transaction. This doesn't test if the signature hash is Bitcoin
	// compatible. The easiest way to check if the signature hash is Bitcoin
	// compatible is to sign a transaction and see if other nodes relay it.
	setTestInputStream(good_full_transaction, sizeof(good_full_transaction));
	parseTransaction(sig_hash, transaction_hash, sizeof(good_full_transaction));
	sha256Begin(&test_hs);
	for (i = 0; i < sizeof(good_main_transaction); i++)
	{
		sha256WriteByte(&test_hs, good_main_transaction[i]);
	}
	sha256FinishDouble(&test_hs);
	writeHashToByteArray(calculated_sig_hash, &test_hs, false);
	if (memcmp(calculated_sig_hash, sig_hash, 32))
	{
		printf("parseTransaction() isn't calculating signature hash properly\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}

	// Check that the transaction hash is a double SHA-256 of the (main)
	// transaction, ignoring input scripts.
	sha256Begin(&test_hs);
	for (i = 0; i < sizeof(good_main_transaction); i++)
	{
		if (i == 41)
		{
			i += 26; // skip input script
		}
		sha256WriteByte(&test_hs, good_main_transaction[i]);
	}
	sha256FinishDouble(&test_hs);
	writeHashToByteArray(calculated_transaction_hash, &test_hs, false);
	if (memcmp(calculated_transaction_hash, transaction_hash, 32))
	{
		printf("parseTransaction() isn't calculating transaction hash properly\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}

	// Now change one byte in the input script. The signature hash should
	// change, but the transaction hash should not.
	memcpy(bad_full_transaction, good_full_transaction, sizeof(good_full_transaction));
	bad_full_transaction[305] = 0x04; // first byte of input script
	setTestInputStream(bad_full_transaction, sizeof(good_full_transaction));
	parseTransaction(sig_hash_input_changed, transaction_hash_input_changed, sizeof(good_full_transaction));
	if (!memcmp(sig_hash_input_changed, sig_hash, 32))
	{
		printf("Signature hash doesn't change when input script changes\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}
	if (memcmp(transaction_hash_input_changed, transaction_hash, 32))
	{
		printf("Transaction hash changes when input script changes\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}

	// As a sanity check, change one byte in an output script. Both the
	// signature and transaction hashes should change.
	memcpy(bad_full_transaction, good_full_transaction, sizeof(good_full_transaction));
	bad_full_transaction[366] = 0x00; // last byte of output address
	setTestInputStream(bad_full_transaction, sizeof(good_full_transaction));
	parseTransaction(sig_hash_output_changed, transaction_hash_output_changed, sizeof(good_full_transaction));
	if (!memcmp(sig_hash_output_changed, sig_hash, 32))
	{
		printf("Signature hash doesn't change when output script changes\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}
	if (!memcmp(transaction_hash_output_changed, transaction_hash, 32))
	{
		printf("Transaction hash doesn't change when output script changes\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}

	// Check that the transaction parser doesn't choke on a transaction
	// with the maximum possible size. This test takes a while.
	testTransaction(NULL, 0xffffffff, "max_size", TRANSACTION_TOO_LARGE);

	// Go through encapsulateSignature() tests.
	num_tests = sizeof(encapsulate_tests) / sizeof(struct EncapsulateSignatureTestStruct);
	for (i = 0; i < num_tests; i++)
	{
		signature_length = encapsulateSignature(signature, (uint8_t *)(encapsulate_tests[i].r), (uint8_t *)(encapsulate_tests[i].s));
		if (signature_length != encapsulate_tests[i].expected_length)
		{
			printf("Signature length mismatch on encapsulateSignature() test %d\n", i);
			reportFailure();
		}
		else
		{
			if (memcmp(signature, encapsulate_tests[i].expected_signature, signature_length))
			{
				printf("Signature contents mismatch on encapsulateSignature() test %d\n", i);
				reportFailure();
			}
			else
			{
				reportSuccess();
			}
		}
	}

	// Check that signTransaction() actually writes to the signature buffer and
	// signature length.
	memset(signature, 0, sizeof(signature));
	memset(&signature_length, 0, sizeof(signature_length));
	memset(sig_hash, 42, 32);
	signTransaction(signature, &signature_length, sig_hash, (BigNum256)private_key);
	if ((signature[0] != 0x30)
		|| (signature_length == 0))
	{
		printf("signTransaction() isn't writing to its outputs\n");
		reportFailure();
	}
	else
	{
		reportSuccess();
	}

	finishTests();
	exit(0);
}

#endif // #ifdef TEST_TRANSACTION