DeckerSU · Jun 24, 2026 · Jan 26, 2026 · Jun 9, 2026 · Jun 24, 2026 · Jun 24, 2026
diff --git a/.github/workflows/komodod_cd.yml b/.github/workflows/komodod_cd.yml
@@ -76,7 +76,9 @@ jobs:
 
   osx-build:
     name: OSX Build
-    if: ${{ github.event_name != 'workflow_dispatch' }}
+    # disabled: OSX build is turned off; set back to
+    # `${{ github.event_name != 'workflow_dispatch' }}` to re-enable
+    if: false
     runs-on: macos-latest-large
 
     steps:
@@ -180,16 +182,12 @@ jobs:
       name: Publishing CD releases
       if: ${{ github.event_name != 'workflow_dispatch' }}
       runs-on: ubuntu-22.04
-      needs: [linux-build, osx-build, windows-build]
+      needs: [linux-build, windows-build]
       steps:
         - name: Download komodo-linux.zip
           uses: actions/download-artifact@v4
           with:
-            name: komodo-linux  
-        - name: Download komodo-osx.zip
-          uses: actions/download-artifact@v4
-          with:
-            name: komodo-osx
+            name: komodo-linux
         - name: Download komodo-win.zip
           uses: actions/download-artifact@v4
           with:
@@ -229,16 +227,6 @@ jobs:
             asset_path: ./komodo-linux.zip
             asset_name: komodo_${{ steps.shortify_commit.outputs.sha_short }}_${{ steps.extract_branch.outputs.branch }}_linux.zip
             asset_content_type: application/zip
-        - name: Upload OSX Release Asset
-          id: upload-osx-release-asset 
-          uses: actions/upload-release-asset@latest
-          env:
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          with:
-            upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps 
-            asset_path: ./komodo-osx.zip
-            asset_name: komodo_${{ steps.shortify_commit.outputs.sha_short }}_${{ steps.extract_branch.outputs.branch }}_osx.zip
-            asset_content_type: application/zip
         - name: Upload Windows Release Asset
           id: upload-windows-release-asset 
           uses: actions/upload-release-asset@latest

diff --git a/configure.ac b/configure.ac
@@ -3,7 +3,7 @@ AC_PREREQ([2.60])
 define(_CLIENT_VERSION_MAJOR, 0)
 define(_CLIENT_VERSION_MINOR, 9)
 define(_CLIENT_VERSION_REVISION, 2)
-define(_CLIENT_VERSION_BUILD, 51)
+define(_CLIENT_VERSION_BUILD, 52)
 define(_ZC_BUILD_VAL, m4_if(m4_eval(_CLIENT_VERSION_BUILD < 25), 1, m4_incr(_CLIENT_VERSION_BUILD), m4_eval(_CLIENT_VERSION_BUILD < 50), 1, m4_eval(_CLIENT_VERSION_BUILD - 24), m4_eval(_CLIENT_VERSION_BUILD == 50), 1, , m4_eval(_CLIENT_VERSION_BUILD - 50)))
 define(_CLIENT_VERSION_SUFFIX, m4_if(m4_eval(_CLIENT_VERSION_BUILD < 25), 1, _CLIENT_VERSION_REVISION-beta$1, m4_eval(_CLIENT_VERSION_BUILD < 50), 1, _CLIENT_VERSION_REVISION-rc$1, m4_eval(_CLIENT_VERSION_BUILD == 50), 1, _CLIENT_VERSION_REVISION, _CLIENT_VERSION_REVISION-$1)))
 define(_CLIENT_VERSION_IS_RELEASE, true)

diff --git a/src/cc/heir.cpp b/src/cc/heir.cpp
@@ -281,9 +281,14 @@ uint8_t _DecodeHeirOpRet(vscript_t vopret, CPubKey& ownerPubkey, CPubKey& heirPu
     uint8_t heirFuncId = 0;
 
     fundingTxidInOpret = zeroid; //to init
-
+
+    if (vopret.empty()) {
+        if (!noLogging) std::cerr << "_DecodeHeirOpRet() empty opret" << std::endl;
+        return (uint8_t)0;
+    }
+
     evalCodeInOpret = vopret.begin()[0];
-    
+
     if (vopret.size() > 1 && evalCodeInOpret == EVAL_HEIR) {
         // NOTE: it unmarshals for all F, A and C
         uint8_t heirFuncId = 0;

diff --git a/src/clientversion.h b/src/clientversion.h
@@ -33,7 +33,7 @@
 #define CLIENT_VERSION_MAJOR 0
 #define CLIENT_VERSION_MINOR 9
 #define CLIENT_VERSION_REVISION 2
-#define CLIENT_VERSION_BUILD 51
+#define CLIENT_VERSION_BUILD 52
 
 //! Set to true for release, false for prerelease or test build
 #define CLIENT_VERSION_IS_RELEASE true

diff --git a/src/init.cpp b/src/init.cpp
@@ -438,7 +438,7 @@ std::string HelpMessage(HelpMessageMode mode)
     strUsage += HelpMessageOpt("-onlynet=<net>", _("Only connect to nodes in network <net> (ipv4, ipv6 or onion)"));
     strUsage += HelpMessageOpt("-permitbaremultisig", strprintf(_("Relay non-P2SH multisig (default: %u)"), 1));
     strUsage += HelpMessageOpt("-peerbloomfilters", strprintf(_("Support filtering of blocks and transaction with Bloom filters (default: %u)"), 1));
-    strUsage += HelpMessageOpt("-nspv_msg", strprintf(_("Enable NSPV messages processing (default: %u)"), DEFAULT_NSPV_PROCESSING));
+    strUsage += HelpMessageOpt("-nspv_msg", strprintf(_("Enable NSPV messages processing (NOT SUPPORTED: this mode is disabled, the node will refuse to start) (default: %u)"), DEFAULT_NSPV_PROCESSING));
     if (showDebug)
         strUsage += HelpMessageOpt("-enforcenodebloom", strprintf("Enforce minimum protocol version to limit use of Bloom filters (default: %u)", 0));
     strUsage += HelpMessageOpt("-port=<port>", strprintf(_("Listen for connections on <port> (default: %u or testnet: %u)"), 7770, 17770));
@@ -1195,6 +1195,14 @@ bool AppInit2(boost::thread_group& threadGroup, CScheduler& scheduler)
     if (nFD - MIN_CORE_FILEDESCRIPTORS < nMaxConnections)
         nMaxConnections = nFD - MIN_CORE_FILEDESCRIPTORS;
     fprintf(stderr,"nMaxConnections %d\n",nMaxConnections);
+    // NSPV message processing is disabled: the getnSPV/nSPV handlers
+    // (komodo_nSPVreq/komodo_nSPVresp) do hand-rolled, insufficiently bounds-checked
+    // binary parsing of attacker-controlled P2P payloads, which is remotely
+    // memory-unsafe (stack buffer overflow / out-of-bounds reads). Refuse to start
+    // with it enabled rather than expose that surface.
+    if (GetBoolArg("-nspv_msg", DEFAULT_NSPV_PROCESSING)) {
+        return InitError(_("NSPV messages processing (-nspv_msg) is not supported: it has been disabled because its P2P message parsing is not memory-safe."));
+    }
     // if using block pruning, then disable txindex
     // also disable the wallet (for now, until SPV support is implemented in wallet)
     if (GetArg("-prune", 0)) {

diff --git a/src/komodo_bitcoind.cpp b/src/komodo_bitcoind.cpp
@@ -633,6 +633,10 @@ int32_t komodo_hasOpRet(int32_t height, uint32_t timestamp)
 
 bool komodo_checkopret(CBlock *pblock, CScript &merkleroot)
 {
+    // guard against a malformed block: the merkleroot opret lives in the last
+    // vout of the last tx, but vtx/vout may be empty before per-tx validation
+    if ( pblock->vtx.empty() || pblock->vtx.back().vout.empty() )
+        return false;
     merkleroot = pblock->vtx.back().vout.back().scriptPubKey;
     return(merkleroot.IsOpReturn() && merkleroot == komodo_makeopret(pblock, false));
 }

diff --git a/src/main.cpp b/src/main.cpp
@@ -3427,7 +3427,6 @@ bool ConnectBlock(const CBlock& block, CValidationState& state, CBlockIndex* pin
         }
     }
     */
-    CCheckQueueControl<CScriptCheck> control(fExpensiveChecks && nScriptCheckThreads ? &scriptcheckqueue : NULL);
 
     int64_t nTimeStart = GetTimeMicros();
     CAmount nFees = 0;
@@ -3473,6 +3472,13 @@ bool ConnectBlock(const CBlock& block, CValidationState& state, CBlockIndex* pin
     CAmount burnedAmountDelta = 0;
     std::vector<PrecomputedTransactionData> txdata;
     txdata.reserve(block.vtx.size()); // Required so that pointers to individual PrecomputedTransactionData don't get invalidated
+    // SECURITY (CVE-2024-52911 class, use-after-free): `control` MUST be declared
+    // AFTER `txdata`. Local objects are destroyed in reverse order of construction,
+    // so this guarantees `control` is destroyed FIRST — its destructor (Wait) joins
+    // all background script-check threads while `txdata` (the PrecomputedTransactionData
+    // they hold pointers into) is still alive. Reordering these two declarations
+    // reintroduces the use-after-free on any early return. Do NOT move this above txdata.
+    CCheckQueueControl<CScriptCheck> control(fExpensiveChecks && nScriptCheckThreads ? &scriptcheckqueue : NULL);
     for (unsigned int i = 0; i < block.vtx.size(); i++)
     {
         const CTransaction &tx = block.vtx[i];
@@ -5108,7 +5114,7 @@ bool CheckBlock(int32_t *futureblockp, int32_t height, CBlockIndex *pindex, cons
         CValidationState& state, libzcash::ProofVerifier& verifier, bool fCheckPOW, 
         bool fCheckMerkleRoot)
 {
-    uint8_t pubkey33[33]; 
+    uint8_t pubkey33[33] = {0}; // init: komodo_block2pubkey33() only runs under fCheckPOW, but the December-hardfork branch below reads pubkey33 unconditionally
     uint32_t tiptime = (uint32_t)block.nTime;
     // These are checks that are independent of context.
     uint256 hash = block.GetHash();

diff --git a/src/rpc/misc.cpp b/src/rpc/misc.cpp
@@ -81,7 +81,7 @@ int8_t StakedNotaryID(std::string &notaryname, char *Raddress);
 uint64_t komodo_notarypayamount(int32_t nHeight, int64_t notarycount);
 int32_t komodo_notaries(uint8_t pubkeys[64][33],int32_t height,uint32_t timestamp);*/
 
-#define KOMODO_VERSION "0.9.2-1"
+#define KOMODO_VERSION "0.9.2-2"
 extern uint16_t ASSETCHAINS_P2PPORT,ASSETCHAINS_RPCPORT;
 extern uint32_t ASSETCHAINS_CC;
 extern uint32_t ASSETCHAINS_MAGIC,ASSETCHAINS_ALGO;

diff --git a/src/script/script.cpp b/src/script/script.cpp
@@ -497,8 +497,8 @@ bool CScript::IsCoinImport() const
     vector<unsigned char> data;
     opcodetype opcode;
     if (this->GetOp(pc, opcode, data))
-        if (opcode > OP_0 && opcode <= OP_PUSHDATA4)
-            return data.begin()[0] == EVAL_IMPORTCOIN;
+        if (opcode > OP_0 && opcode <= OP_PUSHDATA4 && !data.empty())
+            return data[0] == EVAL_IMPORTCOIN;
     return false;
 }