From 8c511722e0a431622db32957f9225cd3c8abe1ca Mon Sep 17 00:00:00 2001
From: xiphon <xiphon@protonmail.com>
Date: Tue, 17 Dec 2019 21:49:58 +0000
Subject: Subaddress: fix use-after-free on accessing stale Wallet API data

---
 src/libwalletqt/Subaddress.cpp | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

(limited to 'src/libwalletqt/Subaddress.cpp')

diff --git a/src/libwalletqt/Subaddress.cpp b/src/libwalletqt/Subaddress.cpp
index 9d07b05c..daa45d20 100644
--- a/src/libwalletqt/Subaddress.cpp
+++ b/src/libwalletqt/Subaddress.cpp
@@ -36,49 +36,58 @@ Subaddress::Subaddress(Monero::Subaddress *subaddressImpl, QObject *parent)
     getAll();
 }
 
-QList<Monero::SubaddressRow*> Subaddress::getAll(bool update) const
+void Subaddress::getAll() const
 {
     qDebug(__FUNCTION__);
 
     emit refreshStarted();
 
-    if(update)
-        m_rows.clear();
+    {
+        QWriteLocker locker(&m_lock);
 
-    if (m_rows.empty()){
+        m_rows.clear();
         for (auto &row: m_subaddressImpl->getAll()) {
             m_rows.append(row);
         }
     }
 
     emit refreshFinished();
-    return m_rows;
 }
 
-Monero::SubaddressRow * Subaddress::getRow(int index) const
+bool Subaddress::getRow(int index, std::function<void (Monero::SubaddressRow &row)> callback) const
 {
-    return m_rows.at(index);
+    QReadLocker locker(&m_lock);
+
+    if (index < 0 || index >= m_rows.size())
+    {
+        return false;
+    }
+
+    callback(*m_rows.value(index));
+    return true;
 }
 
 void Subaddress::addRow(quint32 accountIndex, const QString &label) const
 {
     m_subaddressImpl->addRow(accountIndex, label.toStdString());
-    getAll(true);
+    getAll();
 }
 
 void Subaddress::setLabel(quint32 accountIndex, quint32 addressIndex, const QString &label) const
 {
     m_subaddressImpl->setLabel(accountIndex, addressIndex, label.toStdString());
-    getAll(true);
+    getAll();
 }
 
 void Subaddress::refresh(quint32 accountIndex) const
 {
     m_subaddressImpl->refresh(accountIndex);
-    getAll(true);
+    getAll();
 }
 
 quint64 Subaddress::count() const
 {
+    QReadLocker locker(&m_lock);
+
     return m_rows.size();
 }
-- 
cgit v1.2.3