From 59777ee34a5ab6297684b7ab8d5d93facd4ad6f3 Mon Sep 17 00:00:00 2001 From: mtg0001 <106211915+mtg0001@users.noreply.github.com> Date: Fri, 31 Jul 2026 16:05:35 -0300 Subject: net: bound what a peer can make the node allocate (#73) Three independent bounds on what an untrusted peer can make this node allocate: - serialize.h: reject a compact size above MAX_SIZE before reading a string or a vector, instead of discovering it read by read. MAX_SIZE moves from main.h to serialize.h, where the checks live; headers_core.h includes serialize.h first, so every existing user still sees it. - main.cpp: cap an orphan transaction at 10,000 inputs. Orphans are stored and never validated, so mapOrphanTransactionsByPrev grew with one entry per input of every orphan a peer cared to send. - rpc.cpp: drop a Stratum line nested deeper than 20 before json::parse recurses into it. The scan tracks string state, so a worker name containing { or [ is no longer mistaken for nesting. Verified: builds clean on UCRT64; the depth scanner passes a table of legitimate Stratum lines and nesting attacks; a node built from this branch synced the chain from genesis to 4462 with no deserialization failure and no rejected block. --- src/serialize.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src/serialize.h') diff --git a/src/serialize.h b/src/serialize.h index ce72c60..fa77074 100644 --- a/src/serialize.h +++ b/src/serialize.h @@ -20,7 +20,7 @@ class CDataStream; class CAutoFile; static const int VERSION = 101; - +static const unsigned int MAX_SIZE = 0x02000000; @@ -399,6 +399,8 @@ void Unserialize(Stream& is, basic_string& str, int, int) // only string field on a serialized type and RelayMessage casts it away -- // so this is a guard against the next one that does, not a live hole. unsigned int nSize = ReadCompactSize(is); + if (nSize > MAX_SIZE) + throw std::ios_base::failure("String size too large"); str.clear(); unsigned int nMid = 0; while (nMid < nSize) @@ -472,6 +474,8 @@ void Unserialize_impl(Stream& is, std::vector& v, int nType, int nVersion, // Limit size per read so bogus size value won't cause out of memory v.clear(); unsigned int nSize = ReadCompactSize(is); + if (nSize > MAX_SIZE) + throw std::ios_base::failure("Vector size too large"); unsigned int i = 0; while (i < nSize) { @@ -492,6 +496,8 @@ void Unserialize_impl(Stream& is, std::vector& v, int nType, int nVersion, v.clear(); unsigned int nSize = ReadCompactSize(is); + if (nSize > MAX_SIZE) + throw std::ios_base::failure("Vector size too large"); unsigned int i = 0; unsigned int nMid = 0; while (nMid < nSize) -- cgit v1.2.3