From 80fd5cc36b1e1fde61441a5c80e24f7d32a1ef23 Mon Sep 17 00:00:00 2001
From: Alexander Blair <alex@snipanet.com>
Date: Sat, 19 Aug 2017 12:16:08 -0700
Subject: [PATCH] Security Update

Update to patch a small bug in the pool source.  Thanks to MinerCircle for catching this.
---
 lib/pool.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/pool.js b/lib/pool.js
index de2912f..973ba3e 100644
--- a/lib/pool.js
+++ b/lib/pool.js
@@ -724,6 +724,13 @@ function handleMinerData(method, params, ip, portData, sendReply, pushMessage) {
                 }
                 job.submissions.push(params.nonce);
             } else {
+                if (!Number.isInteger(params.poolNonce) || !Number.isInteger(params.workerNonce)) {
+                    console.warn(threadName + 'Malformed nonce: ' + JSON.stringify(params) + ' from ' + miner.logString);
+                    miner.checkBan(false);
+                    sendReply('Duplicate share');
+                    global.database.storeInvalidShare(miner.invalidShareProto);
+                    return;
+                }
                 let nonce_test = `${params.nonce}_${params.poolNonce}_${params.workerNonce}`;
                 if (job.submissions.indexOf(nonce_test) !== -1) {
                     console.warn(threadName + 'Duplicate share: ' + JSON.stringify(params) + ' from ' + miner.logString);