rpc: Properly parse -rpcworkqueue/-rpcthreads
What the developer wrote
Authored by MarcoFalke
rpc: Properly parse -rpcworkqueue/-rpcthreads
Also, remove the trailing unnecessary \n from the two logs.
What changed, and why it matters
This commit fixes how two command-line settings, -rpcworkqueue and -rpcthreads, are read in Bitcoin Core's HTTP server. The old code used a method meant only for whole numbers (GetIntArg) but treated the result as a generic argument, which could lead to incorrect parsing or unexpected behavior. The new code uses the proper GetArg method and removes unnecessary newline characters from two log messages. There is no direct evidence in the commit that this was a security vulnerability, but misconfigured thread or queue limits could affect server stability or resource use.
Treat as a routine correctness fix. Review whether the old parsing path could have caused -rpcworkqueue/-rpcthreads to be ignored or misinterpreted, and assess operational impact on node operators who set these values. No immediate security response is indicated by the available evidence.
Security signals we found
Incorrect argument parsing for -rpcworkqueue and -rpcthreads
Potential type mismatch between GetIntArg return and long cast
No explicit security framing by the vendor
No CVE, advisory, or researcher attribution in commit or references
Evidence from the diff
The patch changes src/httpserver.cpp to use gArgs.GetArg() instead of gArgs.GetIntArg() for -rpcworkqueue and -rpcthreads, with std::max(…, 1) instead of std::max((long)…, 1L). It also removes trailing \n from two LogDebug/LogInfo format strings. The change suggests the previous parsing was semantically wrong (GetIntArg vs GetArg mismatch), which could cause type handling or default-value issues. The commit message frames this as a parsing fix, not a security fix, and no CVE or advisory is referenced.
Changed components
src/httpserver.cppHTTP RPC server initialization-rpcworkqueue argument handling-rpcthreads argument handlingInspect captured patch +4 / −4
diff --git a/src/httpserver.cpp b/src/httpserver.cpp
index 671e1196..7af0896c 100644
--- a/src/httpserver.cpp
+++ b/src/httpserver.cpp
@@ -410,8 +410,8 @@ bool InitHTTPServer(const util::SignalInterrupt& interrupt)
}
LogDebug(BCLog::HTTP, "Initialized HTTP server\n");
- g_max_queue_depth = std::max((long)gArgs.GetIntArg("-rpcworkqueue", DEFAULT_HTTP_WORKQUEUE), 1L);
- LogDebug(BCLog::HTTP, "set work queue of depth %d\n", g_max_queue_depth);
+ g_max_queue_depth = std::max(gArgs.GetArg("-rpcworkqueue", DEFAULT_HTTP_WORKQUEUE), 1);
+ LogDebug(BCLog::HTTP, "set work queue of depth %d", g_max_queue_depth);
// transfer ownership to eventBase/HTTP via .release()
eventBase = base_ctr.release();
@@ -431,8 +431,8 @@ static std::thread g_thread_http;
void StartHTTPServer()
{
- int rpcThreads = std::max((long)gArgs.GetIntArg("-rpcthreads", DEFAULT_HTTP_THREADS), 1L);
- LogInfo("Starting HTTP server with %d worker threads\n", rpcThreads);
+ int rpcThreads = std::max(gArgs.GetArg("-rpcthreads", DEFAULT_HTTP_THREADS), 1);
+ LogInfo("Starting HTTP server with %d worker threads", rpcThreads);
g_threadpool_http.Start(rpcThreads);
g_thread_http = std::thread(ThreadHTTP, eventBase);
}
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.