From 5da7d4c286e8d16bf5bdcad1692cf6cba8d8576a Mon Sep 17 00:00:00 2001
From: Mathias Buus <mathiasbuus@gmail.com>
Date: Tue, 19 Nov 2024 13:29:55 +0100
Subject: [PATCH 1/3] fix audit

---
 lib/audit.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/audit.js b/lib/audit.js
index 6c78e2c9..7c1c0208 100644
--- a/lib/audit.js
+++ b/lib/audit.js
@@ -3,6 +3,8 @@ const flat = require('flat-tree')
 const c = require('compact-encoding')
 const b4a = require('b4a')
 
+const empty = b4a.alloc(32)
+
 // this is optimised for speed over mem atm
 // can be tweaked in the future
 
@@ -33,6 +35,8 @@ module.exports = async function auditCore (core) {
     const leftNode = getNode(left)
     const rightNode = getNode(right)
 
+    if (!rightNode && !leftNode) continue
+
     stack.push(leftNode, rightNode)
 
     if (valid[node.index]) {
@@ -93,9 +97,11 @@ module.exports = async function auditCore (core) {
   return corrections
 
   function getNode (index) {
+    if (index * 40 + 40 > tree.byteLength) return null
     const state = { start: index * 40, end: index * 40 + 40, buffer: tree }
     const size = c.uint64.decode(state)
     const hash = c.fixed32.decode(state)
+    if (size === 0 && hash.equals(empty)) return null
     return { index, size, hash }
   }
 

From 0d7ad9128cdf6ca5af5ac7a7c0ab1230e2bdf028 Mon Sep 17 00:00:00 2001
From: Mathias Buus <mathiasbuus@gmail.com>
Date: Tue, 19 Nov 2024 13:34:04 +0100
Subject: [PATCH 2/3] 10.38.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1addb23a..e0da8412 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "hypercore",
-  "version": "10.38.0",
+  "version": "10.38.1",
   "description": "Hypercore is a secure, distributed append-only log",
   "main": "index.js",
   "scripts": {

From 7ceb790338971b7019901527f0c7da15920137fa Mon Sep 17 00:00:00 2001
From: Mathias Buus <mathiasbuus@gmail.com>
Date: Tue, 19 Nov 2024 13:39:31 +0100
Subject: [PATCH 3/3] fix bad test

---
 test/manifest.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/manifest.js b/test/manifest.js
index f7c0cf3e..6cf8ab73 100644
--- a/test/manifest.js
+++ b/test/manifest.js
@@ -170,10 +170,10 @@ test('create verifier - multi signer', async function (t) {
   const asig = crypto.sign(batch.signable(verifier.manifestHash), a.secretKey)
   const bsig = crypto.sign(batch.signable(verifier.manifestHash), b.secretKey)
 
-  const signature = assemble([{ signer: 0, signature: asig }, { signer: 1, signature: bsig }])
-  const badSignature = assemble([{ signer: 0, signature: asig }, { signer: 1, signature: asig }])
-  const secondBadSignature = assemble([{ signer: 0, signature: asig }, { signer: 0, signature: asig }])
-  const thirdBadSignature = assemble([{ signer: 0, signature: asig }])
+  const signature = assemble([{ signer: 0, signature: asig, patch: 0 }, { signer: 1, signature: bsig, patch: 0 }])
+  const badSignature = assemble([{ signer: 0, signature: asig, patch: 0 }, { signer: 1, signature: asig, patch: 0 }])
+  const secondBadSignature = assemble([{ signer: 0, signature: asig, patch: 0 }, { signer: 0, signature: asig, patch: 0 }])
+  const thirdBadSignature = assemble([{ signer: 0, signature: asig, patch: 0 }])
 
   t.ok(verifier.verify(batch, signature))
   t.absent(verifier.verify(batch, badSignature))