Browse Source

Fixes a race condition in CreateNewBlock and a future null deref on testnet.

CreateNewBlock was reading pindexBest at the start before taking the lock
so it was possible to have the the block content not match the prevheader
and this can also trigger a newly added assert in ConnectBlock.

I noticed this during a code review after twobitcoins reported that ab91bf39
(BIP30 for all blocks) could cause a null dereference on a modified node
that mined during the IBD, or on testnet when it reached heights 91842 and
91880 due to CreateNewBlock calling ConnectBlock with pindex->phashBlock NULL.
0.8
Gregory Maxwell 12 years ago
parent
commit
faff50d129
  1. 5
      src/main.cpp

5
src/main.cpp

@ -1558,7 +1558,8 @@ bool CBlock::ConnectBlock(CBlockIndex* pindex, CCoinsViewCache &view, bool fJust
// Now that the whole chain is irreversibly beyond that time it is applied to all blocks except the // Now that the whole chain is irreversibly beyond that time it is applied to all blocks except the
// two in the chain that violate it. This prevents exploiting the issue against nodes in their // two in the chain that violate it. This prevents exploiting the issue against nodes in their
// initial block download. // initial block download.
bool fEnforceBIP30 = !((pindex->nHeight==91842 && pindex->GetBlockHash() == uint256("0x00000000000a4d0a398161ffc163c503763b1f4360639393e0e4c8e300e0caec")) || bool fEnforceBIP30 = (!pindex->phashBlock) || // Enforce on CreateNewBlock invocations which don't have a hash.
!((pindex->nHeight==91842 && pindex->GetBlockHash() == uint256("0x00000000000a4d0a398161ffc163c503763b1f4360639393e0e4c8e300e0caec")) ||
(pindex->nHeight==91880 && pindex->GetBlockHash() == uint256("0x00000000000743f190a18c5577a3c2d2a1f610ae9601ac046a38084ccb7cd721"))); (pindex->nHeight==91880 && pindex->GetBlockHash() == uint256("0x00000000000743f190a18c5577a3c2d2a1f610ae9601ac046a38084ccb7cd721")));
if (fEnforceBIP30) { if (fEnforceBIP30) {
for (unsigned int i=0; i<vtx.size(); i++) { for (unsigned int i=0; i<vtx.size(); i++) {
@ -3750,7 +3751,6 @@ CScript scriptDummy(std::vector<unsigned char>(pszDummy, pszDummy + sizeof(pszDu
CBlock* CreateNewBlock(CReserveKey& reservekey) CBlock* CreateNewBlock(CReserveKey& reservekey)
{ {
CBlockIndex* pindexPrev = pindexBest;
// Create new block // Create new block
auto_ptr<CBlock> pblock(new CBlock()); auto_ptr<CBlock> pblock(new CBlock());
@ -3795,6 +3795,7 @@ CBlock* CreateNewBlock(CReserveKey& reservekey)
int64 nFees = 0; int64 nFees = 0;
{ {
LOCK2(cs_main, mempool.cs); LOCK2(cs_main, mempool.cs);
CBlockIndex* pindexPrev = pindexBest;
CCoinsViewCache view(*pcoinsTip, true); CCoinsViewCache view(*pcoinsTip, true);
// Priority order to process transactions // Priority order to process transactions

Loading…
Cancel
Save