GlcoinCore/elements
1
0
Fork 0
mirror of https://github.com/ElementsProject/elements.git synced 2026-08-16 13:01:19 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix use after free in peg-in mempool logic

Browse source
This commit is contained in:
Gregory Sanders 2018-09-26 11:25:04 -04:00
parent ea9d92d453
commit f6875bd32c
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/txmempool.cpp
View file

@ -635,14 +635,15 @@ void CTxMemPool::removeForBlock(const std::vector<CTransactionRef>& vtx, unsigne
for (std::set<std::pair<uint256, COutPoint> >::const_iterator it = setPeginsSpent.begin(); it != setPeginsSpent.end(); it++) { for (std::set<std::pair<uint256, COutPoint> >::const_iterator it = setPeginsSpent.begin(); it != setPeginsSpent.end(); it++) {
std::map<std::pair<uint256, COutPoint>, uint256>::const_iterator it2 = mapWithdrawsSpentToTxid.find(*it); std::map<std::pair<uint256, COutPoint>, uint256>::const_iterator it2 = mapWithdrawsSpentToTxid.find(*it);
if (it2 != mapWithdrawsSpentToTxid.end()) { if (it2 != mapWithdrawsSpentToTxid.end()) {
txiter txit = mapTx.find(it2->second); uint256 tx_id = it2->second;
txiter txit = mapTx.find(tx_id);
assert(txit != mapTx.end()); assert(txit != mapTx.end());
const CTransaction& tx = txit->GetTx(); const CTransaction& tx = txit->GetTx();
setEntries stage; setEntries stage;
stage.insert(txit); stage.insert(txit);
RemoveStaged(stage, true); RemoveStaged(stage, true);
removeRecursive(tx, MemPoolRemovalReason::CONFLICT); removeRecursive(tx, MemPoolRemovalReason::CONFLICT);
ClearPrioritisation(it2->second); ClearPrioritisation(tx_id);
} }
} }
lastRollingFeeUpdate = GetTime(); lastRollingFeeUpdate = GetTime();