4 files changed, 43 insertions, 3 deletions

diff --git a/src/main.cpp b/src/main.cpp
index 4bc9c4d..c3fb33b 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -282,6 +282,16 @@ void AddOrphanTx(const CDataStream& vMsg)
     uint256 hash = tx.GetHash();
     if (mapOrphanTransactions.count(hash))
         return;
+
+    // Do not allow an orphan to have an unbounded number of inputs.
+    // 10,000 inputs is enough for massive legitimate sweeps, but bounds the total
+    // memory in mapOrphanTransactionsByPrev to ~10,000 * MAX_ORPHAN_TRANSACTIONS.
+    if (tx.vin.size() > 10000)
+    {
+        if (LogAcceptsCategory("net")) printf("AddOrphanTx() : orphan with %d inputs rejected\n", (int)tx.vin.size());
+        return;
+    }
+
     CDataStream* pvMsg = mapOrphanTransactions[hash] = new CDataStream(vMsg);
     foreach(const CTxIn& txin, tx.vin)
         mapOrphanTransactionsByPrev.insert(make_pair(txin.prevout.hash, pvMsg));
diff --git a/src/main.h b/src/main.h
index 3bc1219..7266e3d 100644
--- a/src/main.h
+++ b/src/main.h
@@ -14,7 +14,6 @@ class CBlockIndex;
 class CWalletTx;
 class CKeyItem;
 
-static const unsigned int MAX_SIZE = 0x02000000;
 // Ceiling on transactions held waiting for a parent that has not arrived.
 // They cost a peer nothing to send and are never validated, only stored.
 static const unsigned int MAX_ORPHAN_TRANSACTIONS = 100;
diff --git a/src/rpc.cpp b/src/rpc.cpp
index 285f11b..3db8b94 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -681,7 +681,32 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
                        int& blocksFoundThisSession)
 {
     json req;
-    try { req = json::parse(rawLine); }
+    try {
+        // Fast pre-parse depth check to prevent stack overflow in json::parse.
+        // Legitimate Stratum requests have a depth of at most 4.
+        int depth = 0;
+        bool in_string = false;
+        bool escape = false;
+        for (char c : rawLine) {
+            if (in_string) {
+                if (escape) escape = false;
+                else if (c == '\\') escape = true;
+                else if (c == '"') in_string = false;
+            } else {
+                if (c == '"') in_string = true;
+                else if (c == '{' || c == '[') {
+                    if (++depth > 20) {
+                        LogPrint("worker", "[worker] JSON too deeply nested from %s\n",
+                                 m->address.empty() ? "(unauth)" : m->address.c_str());
+                        return true;
+                    }
+                } else if (c == '}' || c == ']') {
+                    depth--;
+                }
+            }
+        }
+        req = json::parse(rawLine);
+    }
     catch (...) {
         LogPrint("worker", "[worker] JSON parse error from %s: %.80s\n",
                  m->address.empty() ? "(unauth)" : m->address.c_str(),
diff --git a/src/serialize.h b/src/serialize.h
index ce72c60..fa77074 100644
--- a/src/serialize.h
+++ b/src/serialize.h
@@ -20,7 +20,7 @@ class CDataStream;
 class CAutoFile;
 
 static const int VERSION = 101;
-
+static const unsigned int MAX_SIZE = 0x02000000;
 
 
 
@@ -399,6 +399,8 @@ void Unserialize(Stream& is, basic_string<C>& str, int, int)
     // only string field on a serialized type and RelayMessage casts it away --
     // so this is a guard against the next one that does, not a live hole.
     unsigned int nSize = ReadCompactSize(is);
+    if (nSize > MAX_SIZE)
+        throw std::ios_base::failure("String size too large");
     str.clear();
     unsigned int nMid = 0;
     while (nMid < nSize)
@@ -472,6 +474,8 @@ void Unserialize_impl(Stream& is, std::vector<T, A>& v, int nType, int nVersion,
     // Limit size per read so bogus size value won't cause out of memory
     v.clear();
     unsigned int nSize = ReadCompactSize(is);
+    if (nSize > MAX_SIZE)
+        throw std::ios_base::failure("Vector size too large");
     unsigned int i = 0;
     while (i < nSize)
     {
@@ -492,6 +496,8 @@ void Unserialize_impl(Stream& is, std::vector<T, A>& v, int nType, int nVersion,
 
     v.clear();
     unsigned int nSize = ReadCompactSize(is);
+    if (nSize > MAX_SIZE)
+        throw std::ios_base::failure("Vector size too large");
     unsigned int i = 0;
     unsigned int nMid = 0;
     while (nMid < nSize)