Merge pull request #270 from frstrtr/ltc-doge/noderpc-send-mutex-uaf

ltc: fix NodeRPC::Send UAF (thread-race on shared HTTP client) — .157 crash-loop ship-blocker

Author: frstrtr

src/impl/ltc/coin/rpc.cpp

@@ -132,6 +132,7 @@ void NodeRPC::sync_reconnect()
 
 std::string NodeRPC::Send(const std::string &request)
 {
+	std::lock_guard<std::mutex> _rpc_lock(m_rpc_mutex);
 	// Retry once after synchronous reconnect on write/read failure
 	for (int attempt = 0; attempt < 2; ++attempt)
 	{

src/impl/ltc/coin/rpc.hpp

@@ -5,6 +5,7 @@
 #include "node_interface.hpp"
 
 #include <iostream>
+#include <mutex>
 
 #include <core/uint256.hpp>
 #include <core/timer.hpp>
@@ -38,6 +39,11 @@ class NodeRPC : public jsonrpccxx::IClientConnector
     beast::tcp_stream m_stream;
     boost::asio::ip::tcp::resolver m_resolver;
     http::request<http::string_body> m_http_request; 
+    // Serializes Send(): m_http_request + m_stream are NOT thread-safe. The asio
+    // thread_pool worker (clean_tracker->think->score->getblockheader) and the main
+    // thread both drive Send() on this single shared client; without this lock T0's
+    // prepare_payload() frees the Content-Length field element mid-write on T8 -> UAF.
+    std::mutex m_rpc_mutex;
 
     std::unique_ptr<RPCAuthData> m_auth;
     jsonrpccxx::JsonRpcClient m_client;