coins, refactor: Assume state after SetClean in AddFlags to prevent dangling pointers

l0rinc · ryanofsky · l0rinc · commit 6b733699cfc7 · 2024-12-02T13:52:34.000+01:00
Co-authored-by: Ryan Ofsky &lt;ryan@ofsky.org&gt;
diff --git a/src/coins.h b/src/coins.h
@@ -166,11 +166,13 @@ struct CCoinsCacheEntry
     {
         Assume(flags & (DIRTY | FRESH));
         if (!pair.second.m_flags) {
+            Assume(!pair.second.m_prev && !pair.second.m_next);
             pair.second.m_prev = sentinel.second.m_prev;
             pair.second.m_next = &sentinel;
             sentinel.second.m_prev = &pair;
             pair.second.m_prev->second.m_next = &pair;
         }
+        Assume(pair.second.m_prev && pair.second.m_next);
         pair.second.m_flags |= flags;
     }
     static void SetDirty(CoinsCachePair& pair, CoinsCachePair& sentinel) noexcept { AddFlags(DIRTY, pair, sentinel); }
@@ -182,6 +184,7 @@ struct CCoinsCacheEntry
         m_next->second.m_prev = m_prev;
         m_prev->second.m_next = m_next;
         m_flags = 0;
+        m_prev = m_next = nullptr;
     }
     uint8_t GetFlags() const noexcept { return m_flags; }
     bool IsDirty() const noexcept { return m_flags & DIRTY; }

Original file line number	Diff line number	Diff line change
`@@ -166,11 +166,13 @@ struct CCoinsCacheEntry`
`166`	`166`	`{`
`167`	`167`	`Assume(flags & (DIRTY \| FRESH));`
`168`	`168`	`if (!pair.second.m_flags) {`
	`169`	`+ Assume(!pair.second.m_prev && !pair.second.m_next);`
`169`	`170`	`pair.second.m_prev = sentinel.second.m_prev;`
`170`	`171`	`pair.second.m_next = &sentinel;`
`171`	`172`	`sentinel.second.m_prev = &pair;`
`172`	`173`	`pair.second.m_prev->second.m_next = &pair;`
`173`	`174`	`}`
	`175`	`+ Assume(pair.second.m_prev && pair.second.m_next);`
`174`	`176`	`pair.second.m_flags \|= flags;`
`175`	`177`	`}`
`176`	`178`	`static void SetDirty(CoinsCachePair& pair, CoinsCachePair& sentinel) noexcept { AddFlags(DIRTY, pair, sentinel); }`
`@@ -182,6 +184,7 @@ struct CCoinsCacheEntry`
`182`	`184`	`m_next->second.m_prev = m_prev;`
`183`	`185`	`m_prev->second.m_next = m_next;`
`184`	`186`	`m_flags = 0;`
	`187`	`+ m_prev = m_next = nullptr;`
`185`	`188`	`}`
`186`	`189`	`uint8_t GetFlags() const noexcept { return m_flags; }`
`187`	`190`	`bool IsDirty() const noexcept { return m_flags & DIRTY; }`