From 9756be382e64ab060e8d8fd3cefe5bbccc44bb45 Mon Sep 17 00:00:00 2001 From: Luke Dashjr Date: Sun, 8 Jan 2017 20:33:33 +0000 Subject: [PATCH] Wallet/RPC: Use filename rather than CWallet pointer, for lockwallet RPCRunLater job name The job name is logged, and could pose as an information leak to someone attacking the process, helping them counteract ASLR protections --- src/wallet/rpcwallet.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp index 60f08b91c..148f0abe8 100644 --- a/src/wallet/rpcwallet.cpp +++ b/src/wallet/rpcwallet.cpp @@ -2077,7 +2077,7 @@ UniValue walletpassphrase(const JSONRPCRequest& request) int64_t nSleepTime = request.params[1].get_int64(); pwallet->nRelockTime = GetTime() + nSleepTime; - RPCRunLater(strprintf("lockwallet_%u", uintptr_t(pwallet)), boost::bind(LockWallet, pwallet), nSleepTime); + RPCRunLater(strprintf("lockwallet(%s)", pwallet->strWalletFile), boost::bind(LockWallet, pwallet), nSleepTime); return NullUniValue; }