net: bound what a peer can make the node allocate (#73)

Three independent bounds on what an untrusted peer can make this node allocate:

- serialize.h: reject a compact size above MAX_SIZE before reading a string or a
  vector, instead of discovering it read by read. MAX_SIZE moves from main.h to
  serialize.h, where the checks live; headers_core.h includes serialize.h first,
  so every existing user still sees it.
- main.cpp: cap an orphan transaction at 10,000 inputs. Orphans are stored and
  never validated, so mapOrphanTransactionsByPrev grew with one entry per input
  of every orphan a peer cared to send.
- rpc.cpp: drop a Stratum line nested deeper than 20 before json::parse recurses
  into it. The scan tracks string state, so a worker name containing { or [ is
  no longer mistaken for nesting.

Verified: builds clean on UCRT64; the depth scanner passes a table of legitimate
Stratum lines and nesting attacks; a node built from this branch synced the chain
from genesis to 4462 with no deserialization failure and no rejected block.

1 files changed, 10 insertions, 0 deletions

diff --git a/src/main.cpp b/src/main.cpp
index 4bc9c4d..c3fb33b 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -282,6 +282,16 @@ void AddOrphanTx(const CDataStream& vMsg)
     uint256 hash = tx.GetHash();
     if (mapOrphanTransactions.count(hash))
         return;
+
+    // Do not allow an orphan to have an unbounded number of inputs.
+    // 10,000 inputs is enough for massive legitimate sweeps, but bounds the total
+    // memory in mapOrphanTransactionsByPrev to ~10,000 * MAX_ORPHAN_TRANSACTIONS.
+    if (tx.vin.size() > 10000)
+    {
+        if (LogAcceptsCategory("net")) printf("AddOrphanTx() : orphan with %d inputs rejected\n", (int)tx.vin.size());
+        return;
+    }
+
     CDataStream* pvMsg = mapOrphanTransactions[hash] = new CDataStream(vMsg);
     foreach(const CTxIn& txin, tx.vin)
         mapOrphanTransactionsByPrev.insert(make_pair(txin.prevout.hash, pvMsg));