highperfocused/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2026-04-08 22:57:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

validation: fix UB in LoadChainTip

Browse Source 
The removal of the chain tip from setBlockIndexCandidates was
happening after nSequenceId was modified. Since the set uses
nSequenceId as a sort key, modifying it while the element is in the
set is undefined behavior, which can cause the erase to fail.

With assumeutxo, a second form of UB exists: two chainstates each
have their own candidate set, but share the same CBlockIndex
objects. Calling LoadChainTip on one chainstate mutates nSequenceIds
that are also in the other chainstate's set.

Fix by populating setBlockIndexCandidates after all changes to
nSequenceId.
This commit is contained in:
marcofleon
2026-03-04 19:39:20 +00:00
parent 9249e6089e
commit 854a6d5a9a
5 changed files with 45 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/test/validation_chainstatemanager_tests.cpp
View File

@@ -76,8 +76,13 @@ BOOST_FIXTURE_TEST_CASE(chainstatemanager, TestChain100Setup)
LOCK(::cs_main);
c2.InitCoinsCache(1 << 23);
c2.CoinsTip().SetBestBlock(active_tip->GetBlockHash());
c2.setBlockIndexCandidates.insert(manager.m_blockman.LookupBlockIndex(active_tip->GetBlockHash()));
for (const auto& cs : manager.m_chainstates) {
cs->ClearBlockIndexCandidates();
}
c2.LoadChainTip();
for (const auto& cs : manager.m_chainstates) {
cs->PopulateBlockIndexCandidates();
}
}
BlockValidationState _;
BOOST_CHECK(c2.ActivateBestChain(_, nullptr));
@@ -492,6 +497,9 @@ BOOST_FIXTURE_TEST_CASE(chainstatemanager_loadblockindex, TestChain100Setup)
BOOST_CHECK(cs->setBlockIndexCandidates.empty());
}
chainman.LoadBlockIndex();
for (const auto& cs : chainman.m_chainstates) {
cs->PopulateBlockIndexCandidates();
}
};
// Ensure that without any assumed-valid BlockIndex entries, only the current tip is