monero-project/monero
monero-project/monero
1
0
Fork 0
mirror of https://github.com/monero-project/monero.git synced 2024-11-17 16:27:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

cryptonote_protocol_handler: prevent potential DoS

Browse source 
Essentially, one can send such a large amount of IDs that core exhausts
all free memory. This issue can theoretically be exploited using very
large CN blockchains, such as Monero.

This is a partial fix. Thanks and credit given to CryptoNote author
'cryptozoidberg' for collaboration and the fix. Also thanks to
'moneromooo'. Referencing HackerOne report #506595.
This commit is contained in:
anonimal 2019-03-09 09:11:44 +00:00 committed by moneromooo-monero
parent 39169ace09
commit 8f66b7053a
No known key found for this signature in database
GPG key ID: 686F07454D6CEFC3
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/cryptonote_protocol/cryptonote_protocol_handler.h
View file

@ -52,6 +52,7 @@ PUSH_WARNINGS
DISABLE_VS_WARNINGS(4355) DISABLE_VS_WARNINGS(4355)
#define LOCALHOST_INT 2130706433 #define LOCALHOST_INT 2130706433
#define CURRENCY_PROTOCOL_MAX_BLOCKS_REQUEST_COUNT 500
namespace cryptonote namespace cryptonote
{ {

11
src/cryptonote_protocol/cryptonote_protocol_handler.inl
View file

@ -914,6 +914,17 @@ namespace cryptonote
int t_cryptonote_protocol_handler<t_core>::handle_request_get_objects(int command, NOTIFY_REQUEST_GET_OBJECTS::request& arg, cryptonote_connection_context& context) int t_cryptonote_protocol_handler<t_core>::handle_request_get_objects(int command, NOTIFY_REQUEST_GET_OBJECTS::request& arg, cryptonote_connection_context& context)
{ {
MLOG_P2P_MESSAGE("Received NOTIFY_REQUEST_GET_OBJECTS (" << arg.blocks.size() << " blocks, " << arg.txs.size() << " txes)"); MLOG_P2P_MESSAGE("Received NOTIFY_REQUEST_GET_OBJECTS (" << arg.blocks.size() << " blocks, " << arg.txs.size() << " txes)");
if (arg.blocks.size() > CURRENCY_PROTOCOL_MAX_BLOCKS_REQUEST_COUNT)
{
LOG_ERROR_CCONTEXT(
"Requested objects count is too big ("
<< arg.blocks.size() << ") expected not more then "
<< CURRENCY_PROTOCOL_MAX_BLOCKS_REQUEST_COUNT);
drop_connection(context, false, false);
return 1;
}
NOTIFY_RESPONSE_GET_OBJECTS::request rsp; NOTIFY_RESPONSE_GET_OBJECTS::request rsp;
if(!m_core.handle_get_objects(arg, rsp, context)) if(!m_core.handle_get_objects(arg, rsp, context))
{ {