I also had a quick look at yours: The actual adding of the blcok in pushBlock is synchronized on blocks, so any processBlock call would wait there until the blockchain loading request is finished. (since that synchronizes before doing the popping)
It may however, ignore the block that has been sent using processBlock, eventhough it would have been valid.
1. pushBlock() is not sync'ed outside, in "processBlock".It may however, ignore the block that has been sent using processBlock, eventhough it would have been valid.
2. pushBlock creates block and check in validity outside syncronization.
3. Especially dangerous is checks using lastBlock.
4. Than inside syncronization it set processed block as lastBlock, broking what's done in parallel thread.
I think, whole pushBlock() must be sync'ed on blocks.
Any comment, please...
The binary of 0.4.7e that was published weeks ago and used in production does not contain the flaws we are searching here, right? Otherwise that would mean, that we used software that has critical flaws in it. The binary 0.5.0 should have these flaws fixed to, right? Otherwise someone could exploit them, when they are known in this topic.
