From 59777ee34a5ab6297684b7ab8d5d93facd4ad6f3 Mon Sep 17 00:00:00 2001
From: mtg0001 <106211915+mtg0001@users.noreply.github.com>
Date: Fri, 31 Jul 2026 16:05:35 -0300
Subject: net: bound what a peer can make the node allocate (#73)

Three independent bounds on what an untrusted peer can make this node allocate:

- serialize.h: reject a compact size above MAX_SIZE before reading a string or a
  vector, instead of discovering it read by read. MAX_SIZE moves from main.h to
  serialize.h, where the checks live; headers_core.h includes serialize.h first,
  so every existing user still sees it.
- main.cpp: cap an orphan transaction at 10,000 inputs. Orphans are stored and
  never validated, so mapOrphanTransactionsByPrev grew with one entry per input
  of every orphan a peer cared to send.
- rpc.cpp: drop a Stratum line nested deeper than 20 before json::parse recurses
  into it. The scan tracks string state, so a worker name containing { or [ is
  no longer mistaken for nesting.

Verified: builds clean on UCRT64; the depth scanner passes a table of legitimate
Stratum lines and nesting attacks; a node built from this branch synced the chain
from genesis to 4462 with no deserialization failure and no rejected block.
---
 src/main.cpp    | 10 ++++++++++
 src/main.h      |  1 -
 src/rpc.cpp     | 27 ++++++++++++++++++++++++++-
 src/serialize.h |  8 +++++++-
 4 files changed, 43 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/main.cpp b/src/main.cpp
index 4bc9c4d..c3fb33b 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -282,6 +282,16 @@ void AddOrphanTx(const CDataStream& vMsg)
     uint256 hash = tx.GetHash();
     if (mapOrphanTransactions.count(hash))
         return;
+
+    // Do not allow an orphan to have an unbounded number of inputs.
+    // 10,000 inputs is enough for massive legitimate sweeps, but bounds the total
+    // memory in mapOrphanTransactionsByPrev to ~10,000 * MAX_ORPHAN_TRANSACTIONS.
+    if (tx.vin.size() > 10000)
+    {
+        if (LogAcceptsCategory("net")) printf("AddOrphanTx() : orphan with %d inputs rejected\n", (int)tx.vin.size());
+        return;
+    }
+
     CDataStream* pvMsg = mapOrphanTransactions[hash] = new CDataStream(vMsg);
     foreach(const CTxIn& txin, tx.vin)
         mapOrphanTransactionsByPrev.insert(make_pair(txin.prevout.hash, pvMsg));
diff --git a/src/main.h b/src/main.h
index 3bc1219..7266e3d 100644
--- a/src/main.h
+++ b/src/main.h
@@ -14,7 +14,6 @@ class CBlockIndex;
 class CWalletTx;
 class CKeyItem;
 
-static const unsigned int MAX_SIZE = 0x02000000;
 // Ceiling on transactions held waiting for a parent that has not arrived.
 // They cost a peer nothing to send and are never validated, only stored.
 static const unsigned int MAX_ORPHAN_TRANSACTIONS = 100;
diff --git a/src/rpc.cpp b/src/rpc.cpp
index 285f11b..3db8b94 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -681,7 +681,32 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
                        int& blocksFoundThisSession)
 {
     json req;
-    try { req = json::parse(rawLine); }
+    try {
+        // Fast pre-parse depth check to prevent stack overflow in json::parse.
+        // Legitimate Stratum requests have a depth of at most 4.
+        int depth = 0;
+        bool in_string = false;
+        bool escape = false;
+        for (char c : rawLine) {
+            if (in_string) {
+                if (escape) escape = false;
+                else if (c == '\\') escape = true;
+                else if (c == '"') in_string = false;
+            } else {
+                if (c == '"') in_string = true;
+                else if (c == '{' || c == '[') {
+                    if (++depth > 20) {
+                        LogPrint("worker", "[worker] JSON too deeply nested from %s\n",
+                                 m->address.empty() ? "(unauth)" : m->address.c_str());
+                        return true;
+                    }
+                } else if (c == '}' || c == ']') {
+                    depth--;
+                }
+            }
+        }
+        req = json::parse(rawLine);
+    }
     catch (...) {
         LogPrint("worker", "[worker] JSON parse error from %s: %.80s\n",
                  m->address.empty() ? "(unauth)" : m->address.c_str(),
diff --git a/src/serialize.h b/src/serialize.h
index ce72c60..fa77074 100644
--- a/src/serialize.h
+++ b/src/serialize.h
@@ -20,7 +20,7 @@ class CDataStream;
 class CAutoFile;
 
 static const int VERSION = 101;
-
+static const unsigned int MAX_SIZE = 0x02000000;
 
 
 
@@ -399,6 +399,8 @@ void Unserialize(Stream& is, basic_string<C>& str, int, int)
     // only string field on a serialized type and RelayMessage casts it away --
     // so this is a guard against the next one that does, not a live hole.
     unsigned int nSize = ReadCompactSize(is);
+    if (nSize > MAX_SIZE)
+        throw std::ios_base::failure("String size too large");
     str.clear();
     unsigned int nMid = 0;
     while (nMid < nSize)
@@ -472,6 +474,8 @@ void Unserialize_impl(Stream& is, std::vector<T, A>& v, int nType, int nVersion,
     // Limit size per read so bogus size value won't cause out of memory
     v.clear();
     unsigned int nSize = ReadCompactSize(is);
+    if (nSize > MAX_SIZE)
+        throw std::ios_base::failure("Vector size too large");
     unsigned int i = 0;
     while (i < nSize)
     {
@@ -492,6 +496,8 @@ void Unserialize_impl(Stream& is, std::vector<T, A>& v, int nType, int nVersion,
 
     v.clear();
     unsigned int nSize = ReadCompactSize(is);
+    if (nSize > MAX_SIZE)
+        throw std::ios_base::failure("Vector size too large");
     unsigned int i = 0;
     unsigned int nMid = 0;
     while (nMid < nSize)
-- 
cgit v1.2.3