2 files changed, 26 insertions, 0 deletions

diff --git a/src/main.cpp b/src/main.cpp
index a7298ea..17e446e 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -249,6 +249,26 @@ void AddOrphanTx(const CDataStream& vMsg)
     CDataStream* pvMsg = mapOrphanTransactions[hash] = new CDataStream(vMsg);
     foreach(const CTxIn& txin, tx.vin)
         mapOrphanTransactionsByPrev.insert(make_pair(txin.prevout.hash, pvMsg));
+    LimitOrphanTx(MAX_ORPHAN_TRANSACTIONS);
+}
+
+// Orphans cost nothing to create -- a transaction naming a parent that does
+// not exist is never validated, just held -- so without a ceiling any peer can
+// grow this map until the node runs out of memory. Evict at random rather than
+// in map order, so an attacker cannot keep its own orphans resident by
+// choosing hashes that sort low.
+void LimitOrphanTx(unsigned int nMaxOrphans)
+{
+    while (mapOrphanTransactions.size() > nMaxOrphans)
+    {
+        uint256 randomhash;
+        for (int i = 0; i < 4; i++)
+            ((uint64*)&randomhash)[i] = GetRand(_UI64_MAX);
+        map<uint256, CDataStream*>::iterator it = mapOrphanTransactions.lower_bound(randomhash);
+        if (it == mapOrphanTransactions.end())
+            it = mapOrphanTransactions.begin();
+        EraseOrphanTx(it->first);
+    }
 }
 
 void EraseOrphanTx(uint256 hash)
diff --git a/src/main.h b/src/main.h
index 533974c..40f8d45 100644
--- a/src/main.h
+++ b/src/main.h
@@ -15,6 +15,9 @@ class CWalletTx;
 class CKeyItem;
 
 static const unsigned int MAX_SIZE = 0x02000000;
+// Ceiling on transactions held waiting for a parent that has not arrived.
+// They cost a peer nothing to send and are never validated, only stored.
+static const unsigned int MAX_ORPHAN_TRANSACTIONS = 100;
 static const int64 COIN = 100000000;
 // Total Bitflash emission: identical to Bitcoin (21 million).
 // MAX_MONEY guards against the value overflow bug (CVE-2010-5139), which in
@@ -106,6 +109,9 @@ void ReacceptWalletTransactions();
 void RelayWalletTransactions();
 bool LoadBlockIndex(bool fAllowNew=true);
 void PrintBlockTree();
+void AddOrphanTx(const CDataStream& vMsg);
+void EraseOrphanTx(uint256 hash);
+void LimitOrphanTx(unsigned int nMaxOrphans);
 bool BitcoinMiner();
 void ThreadRPCServer(void* parg);  // rpc.cpp -- .btf pool server
 void GetParticipantMiningStats(uint64& sharesSent, uint64& sharesAccepted, double& hashRate);