[29.x] validation: correct lifetime of precomputed tx data #35212

1. 
   darosior commented at 12:24 PM on May 5, 2026: member

   This backports #35209 to the version 29 branch.

2. validation: correct lifetime of precomputed tx data

   This makes sure `txsdata` always outlives the Script check queue (since local
   objects are destructed in reverse order of construction).
   
   This is the root cause for a security vulnerability reported by Cory Fields in
   2024 that could be exploited by crafting an invalid block to cause nodes to
   read freed memory. The vulnerability was covertly fixed in commit
   `492e1f09943fcb6145c21d470299305a19e17d8b`.
   
   See security advisory for CVE-2024-52911 for more details.
   
   Github-Pull: #35209
   Rebased-From: 1ed799fb21db51a12cbd5579420a61b9b5b3ee7d

   9ad085bd83
3. DrahtBot added the label Backport on May 5, 2026
4. 
   DrahtBot commented at 12:24 PM on May 5, 2026: contributor

   <!--e57a25ab6845829454e8d69fc972939a-->

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   <!--006a51241073e994b41acfe9ec718e94-->

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35212.

   <!--021abf342d371248e50ceaed478a90ca-->

   Reviews

   See the guideline for information on the review process.

   Type	Reviewers
   ACK	achow101, theuni

   If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

   <!--5faf32d7da4f0f540f40219e4f7537a3-->

5. fanquake added this to the milestone 29.4 on May 5, 2026
6. fanquake renamed this:
   backport 29.x: validation: correct lifetime of precomputed tx data
   [29.x] validation: correct lifetime of precomputed tx data
   on May 5, 2026
7. 
   achow101 commented at 8:17 AM on May 6, 2026: member

   ACK 9ad085bd8397287e8876673d6b8613add9cf73a1

8. theuni approved
9. 
   theuni commented at 8:18 AM on May 6, 2026: member

   ACK 9ad085bd8397287e8876673d6b8613add9cf73a1

10. achow101 merged this on May 6, 2026
11. achow101 closed this on May 6, 2026

    ---

12. darosior deleted the branch on May 6, 2026

Contributors

darosiorDrahtBotachow101theuni

Milestone
29.4