Merge branch 'release/0.9.23'v0.9.23

1 files changed, 8 insertions, 0 deletions

diff --git a/miner/miner.go b/miner/miner.go
index 3f87e8151..4e99245f8 100644
--- a/miner/miner.go
+++ b/miner/miner.go
@@ -39,6 +39,10 @@ func New(eth core.Backend, mux *event.TypeMux, pow pow.PoW) *Miner {
 	return miner
 }
 
+// update keeps track of the downloader events. Please be aware that this is a one shot type of update loop.
+// It's entered once and as soon as `Done` or `Failed` has been broadcasted the events are unregistered and
+// the loop is exited. This to prevent a major security vuln where external parties can DOS you with blocks
+// and halt your mining operation for as long as the DOS continues.
 func (self *Miner) update() {
 	events := self.mux.Subscribe(downloader.StartEvent{}, downloader.DoneEvent{}, downloader.FailedEvent{})
 	for ev := range events.Chan() {
@@ -59,6 +63,10 @@ func (self *Miner) update() {
 				self.Start(self.coinbase, self.threads)
 			}
 		}
+		// unsubscribe. we're only interested in this event once
+		events.Unsubscribe()
+		// stop immediately and ignore all further pending events
+		break
 	}
 }