Monero

This commit fixes a thread resource leak in Monero's cryptography code. Previously, a helper macro called CTHR_THREAD_CLOSE was defined as doing nothing, meaning threads were created and joined but never properly detached. On systems using POSIX threads (pthreads), this can leave thread resources unreleased, causing gradual memory use growth. The fix makes CTHR_THREAD_CLOSE call pthread_detach, which tells the system it can clean up the thread after it finishes. This is a reliability and resource-management fix rather than a direct remote exploit, but resource exhaustion can sometimes affect service availability.

This Monero patch fixes a RingCT amount-decoding function that previously ignored extra bytes beyond the first 8 in a 32-byte amount field. A pre-v10 'long amount' transaction could hide non-zero padding after the real amount. The receiver's wallet would fail to decode it, but a third-party wallet checking a proof might accept it, creating a mismatch between what the sender proves and what the recipient can actually spend. The change makes the decoder reject such malformed amounts.

This patch fixes two related bugs in how Monero's wallet checks whether a transaction output belongs to your account and how it verifies transaction proofs. The bugs involve using an uninitialized or 'null' key derivation value, which could lead to incorrect matching of outputs or failed proof verification. In the worst case, a wallet might wrongly decide an output belongs to someone else, or an attacker might craft a proof that passes when it should not. The patch adds explicit null-derivation checks and ensures additional derivations are only accessed when they exist.

This commit removes a build-time compatibility check that tested whether the C compiler supports the modern 'static_assert' keyword. It also deletes the small test program used for that check. On its own, this change does not introduce a direct security vulnerability; it is a build-system cleanup. The main risk is that on older compilers that only support the older '_Static_assert' keyword, the build might now fail or behave differently, because the code no longer automatically defines a fallback macro. There is no evidence in the commit of an exploit or security flaw.

This change adds a safety check in Monero's wallet code when verifying a 'reserve proof'—a cryptographic receipt that proves someone owns enough funds. Before this fix, a maliciously crafted proof could include the same output or key image more than once. The patch now rejects such duplicate entries. This likely prevents a proof from being counted multiple times or from confusing the verification logic, which could otherwise make someone appear richer than they really are.

This commit simply removes an unused 'tags' target from the Makefile. The target generated source-code tags for developer navigation and had no security relevance. There is no vulnerability or security fix here.

This commit removes a small helper function named 'die' from the project's build configuration files and replaces its three uses with CMake's standard 'message(FATAL_ERROR ...)' command. The helper added red/bold color to error messages during the build setup. There is no security relevance: the build still stops with the exact same error text when required libraries are missing.

This commit simply removes one unused build variable from the Makefile. It does not change any compiled code, runtime behavior, or security logic. There is no security relevance.

This is a minor code cleanup that moves preprocessor guards (#if defined __i386 || defined __x86_64__) so that two x86-only byte arrays are only compiled on x86 platforms. It eliminates a compiler warning about unused constant variables on non-x86 builds and has no security relevance.

This commit removes unused variables and comments out one unused variable to silence compiler warnings. It does not change program behavior or fix any security issue. The wallet code contains an old developer comment about a past race condition, but this patch does not address it.

This commit only silences compiler warnings about unused function return values. It does not fix a security vulnerability. One change makes a test program check whether protobuf serialization succeeded, and the other explicitly discards return values from default_instance() calls that are only meant to trigger package initialization.

This commit simply removes unused helper functions from a cryptographic source file to silence compiler warnings. No behavior changes, no bug fixes, and no security issue is present in the diff.