| Age | Commit message (Collapse) | Author |
|---|
|
Three independent bounds on what an untrusted peer can make this node allocate:
- serialize.h: reject a compact size above MAX_SIZE before reading a string or a
vector, instead of discovering it read by read. MAX_SIZE moves from main.h to
serialize.h, where the checks live; headers_core.h includes serialize.h first,
so every existing user still sees it.
- main.cpp: cap an orphan transaction at 10,000 inputs. Orphans are stored and
never validated, so mapOrphanTransactionsByPrev grew with one entry per input
of every orphan a peer cared to send.
- rpc.cpp: drop a Stratum line nested deeper than 20 before json::parse recurses
into it. The scan tracks string state, so a worker name containing { or [ is
no longer mistaken for nesting.
Verified: builds clean on UCRT64; the depth scanner passes a table of legitimate
Stratum lines and nesting attacks; a node built from this branch synced the chain
from genesis to 4462 with no deserialization failure and no rejected block.
|
|
The vector unserializer grows in 5 MB steps so a bogus length cannot make
it allocate more than has actually been received. The string one resized
straight to whatever ReadCompactSize returned, and ReadCompactSize has no
ceiling -- nine bytes on the wire can name four gigabytes.
Not reachable from the network today: the only string on a serialized
type is CWalletTx::mapValue, and RelayMessage casts to CTransaction
before sending, so it never leaves disk. This is a guard against the next
network message that carries a string -- Bitcoin's own version message
carries strSubVer -- rather than a fix for a live hole.
|
|
Satoshi's bitcoin-0.1.0 reborn with RandomX CPU proof of work, anonymous .btf
addressing over Nostr with CGNAT rendezvous, automatic peer discovery, a
headless Linux node, and Windows GUI wallet. Fair launch, no premine, 21M cap.
|