Skip to content

MerkleBlockPayload need to ensure the deserialization #1375

@shargon

Description

@shargon

Describe the bug
MerkleBlockPayload doesn't check the limits of the expected values, in all of them the maximum values are Block.MaxTransactionsPerBlock. If we don't check this we can allocate more memory than expected.

To Reproduce
Steps to reproduce the behavior:

  1. Create a crafted MerkleBlockPayload with 16777216 Hashes (only the prefix, not the content)
  2. OnDeserialize it will allocate 16mb of items.
  3. It could produce a Deny of Service if a lot of nodes are doing the same at same time.

Expected behavior
Expect only MaxTransactionsPerBlock.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions