Skip to content

GUI/NetWatch: Fix heap corruption from off-thread model mutation #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kwsantiago wants to merge 3 commits into
base: 29.x-knots
Choose a base branch
from
Open

GUI/NetWatch: Fix heap corruption from off-thread model mutation #330

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d4c389b
GUI/NetWatch: Marshal validation callbacks to the GUI thread
kwsantiago Jul 10, 2026
26ec084
GUI/NetWatch: Unregister validation interface before deleting it
kwsantiago Jul 10, 2026
191d0fd
GUI/NetWatch: Fix operator new/delete mismatch in LogEntry
kwsantiago Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 19 additions & 5 deletions src/qt/netwatch.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ void LogEntry::clear()
break;
default: assert(false);
}
delete m_data;
::operator delete(m_data);
}

LogEntry::~LogEntry()
Expand Down Expand Up @@ -280,12 +280,22 @@ void NetWatchValidationInterface::ValidationInterfaceUnregistering()

void NetWatchValidationInterface::BlockConnected(ChainstateRole role, const std::shared_ptr<const CBlock>& block, const CBlockIndex* pindex)
{
model.LogBlock(pindex, block);
// Callbacks run on the scheduler thread; Qt models may only be mutated on
// the GUI thread. Marshal there (capturing the model, not this interface,
// which may be deleted before the event is delivered).
NetWatchLogModel* const model_ptr = &model;
QMetaObject::invokeMethod(model_ptr, [model_ptr, block, pindex] {
model_ptr->LogBlock(pindex, block);
}, Qt::QueuedConnection);
}

void NetWatchValidationInterface::TransactionAddedToMempool(const NewMempoolTransactionInfo& txinfo, uint64_t mempool_sequence)
{
model.LogTransaction(txinfo.info.m_tx);
NetWatchLogModel* const model_ptr = &model;
const CTransactionRef tx = txinfo.info.m_tx;
QMetaObject::invokeMethod(model_ptr, [model_ptr, tx] {
model_ptr->LogTransaction(tx);
}, Qt::QueuedConnection);
}

NetWatchLogModel::NetWatchLogModel(QWidget *parent) :
Expand Down Expand Up @@ -680,8 +690,12 @@ void NetWatchLogModel::LogTransaction(const CTransactionRef& tx)
void NetWatchLogModel::setClientModel(ClientModel *model)
{
if (m_client_model) {
delete m_validation_interface;
m_validation_interface = nullptr;
if (m_validation_interface) {
Assert(m_client_model->node().context()->validation_signals);
m_client_model->node().context()->validation_signals->UnregisterValidationInterface(m_validation_interface);
delete m_validation_interface;
m_validation_interface = nullptr;
}

disconnect(m_client_model->getOptionsModel(), &OptionsModel::displayUnitChanged, this, &NetWatchLogModel::updateDisplayUnit);
disconnect(m_client_model->getOptionsModel(), &OptionsModel::fontForMoneyChanged, this, &NetWatchLogModel::updateDisplayUnit);
Expand Down
Loading