nostr: bound what a relay can make the node allocate (#17)

The node connects to public Nostr relays it does not run, and the
WebSocket reader trusted them completely.

A frame's payload length is read from the wire -- up to 64 bits when the
extended form is used -- and passed straight to string::resize(). One
frame header claiming 2^40 bytes is enough to make the node allocate
until it dies. Reassembly across continuation frames had no ceiling
either, so the same result was reachable with small frames. Frames are
now capped at 1 MiB and a reassembled message at 4 MiB; the frame cap
also keeps the length inside the int that ReadN takes, which a 64-bit
value would otherwise have narrowed, possibly to a negative.

Six message loops then did:

    if (!j.is_array() || j.empty()) continue;
    string type = j[0].get<string>();

j[0] was never checked to be a string, so a relay answering with [1]
threw an uncaught json::type_error and took the thread down. Same shape
as the descriptor bug fixed in #12, in six more places.

Nothing here is consensus -- this is the relay-facing edge only.

0 files changed, 0 insertions, 0 deletions