fix: bound CoinJoin entry intake

Author: thepastaclaw

src/coinjoin/coinjoin.h

@@ -167,9 +167,39 @@ class CCoinJoinEntry
     {
     }
 
-    SERIALIZE_METHODS(CCoinJoinEntry, obj)
+    template <typename Stream>
+    void Serialize(Stream& s) const
     {
-        READWRITE(obj.vecTxDSIn, obj.txCollateral, obj.vecTxOut);
+        s << vecTxDSIn << txCollateral << vecTxOut;
+    }
+
+    template <typename Stream>
+    void Unserialize(Stream& s)
+    {
+        vecTxDSIn.clear();
+        vecTxOut.clear();
+
+        const size_t txdsin_size = ReadCompactSize(s);
+        if (txdsin_size > COINJOIN_ENTRY_MAX_SIZE) {
+            throw std::ios_base::failure("CCoinJoinEntry::vecTxDSIn size too large");
+        }
+        vecTxDSIn.reserve(txdsin_size);
+        while (vecTxDSIn.size() < txdsin_size) {
+            vecTxDSIn.emplace_back();
+            s >> vecTxDSIn.back();
+        }
+
+        s >> txCollateral;
+
+        const size_t txout_size = ReadCompactSize(s);
+        if (txout_size > COINJOIN_ENTRY_MAX_SIZE) {
+            throw std::ios_base::failure("CCoinJoinEntry::vecTxOut size too large");
+        }
+        vecTxOut.reserve(txout_size);
+        while (vecTxOut.size() < txout_size) {
+            vecTxOut.emplace_back();
+            s >> vecTxOut.back();
+        }
     }
 
     bool AddScriptSig(const CTxIn& txin);

src/coinjoin/server.cpp

@@ -592,19 +592,26 @@ bool CCoinJoinServer::AddEntry(const CCoinJoinEntry& entry, PoolMessage& nMessag
         return false;
     }
 
-    if (!CoinJoin::IsCollateralValid(m_chainman, m_isman, mempool, *entry.txCollateral)) {
-        LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: collateral not valid!\n", __func__);
-        nMessageIDRet = ERR_INVALID_COLLATERAL;
+    if (entry.vecTxDSIn.size() > COINJOIN_ENTRY_MAX_SIZE) {
+        LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: too many inputs! %d/%d\n", __func__, entry.vecTxDSIn.size(), COINJOIN_ENTRY_MAX_SIZE);
+        nMessageIDRet = ERR_MAXIMUM;
+        ConsumeCollateral(entry.txCollateral);
         return false;
     }
 
-    if (entry.vecTxDSIn.size() > COINJOIN_ENTRY_MAX_SIZE) {
-        LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: too many inputs! %d/%d\n", __func__, entry.vecTxDSIn.size(), COINJOIN_ENTRY_MAX_SIZE);
+    if (entry.vecTxOut.size() > COINJOIN_ENTRY_MAX_SIZE) {
+        LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: too many outputs! %d/%d\n", __func__, entry.vecTxOut.size(), COINJOIN_ENTRY_MAX_SIZE);
         nMessageIDRet = ERR_MAXIMUM;
         ConsumeCollateral(entry.txCollateral);
         return false;
     }
 
+    if (!CoinJoin::IsCollateralValid(m_chainman, m_isman, mempool, *entry.txCollateral)) {
+        LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: collateral not valid!\n", __func__);
+        nMessageIDRet = ERR_INVALID_COLLATERAL;
+        return false;
+    }
+
     std::vector<CTxIn> vin;
     for (const auto& txin : entry.vecTxDSIn) {
         LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- txin=%s\n", __func__, txin.ToString());

src/test/coinjoin_inouts_tests.cpp

@@ -14,6 +14,7 @@
 #include <coinjoin/common.h>
 #include <evo/chainhelper.h>
 #include <script/script.h>
+#include <streams.h>
 #include <uint256.h>
 #include <util/check.h>
 #include <util/time.h>
@@ -155,6 +156,29 @@ BOOST_AUTO_TEST_CASE(entry_addscriptsig_matches_and_rejects)
     }
 }
 
+BOOST_AUTO_TEST_CASE(entry_rejects_oversized_vectors_before_materializing)
+{
+    {
+        CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+        WriteCompactSize(stream, COINJOIN_ENTRY_MAX_SIZE + 1);
+
+        CCoinJoinEntry entry;
+        BOOST_CHECK_THROW(stream >> entry, std::ios_base::failure);
+        BOOST_CHECK(entry.vecTxDSIn.empty());
+    }
+
+    {
+        CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+        WriteCompactSize(stream, 0);
+        stream << MakeTransactionRef(CMutableTransaction{});
+        WriteCompactSize(stream, COINJOIN_ENTRY_MAX_SIZE + 1);
+
+        CCoinJoinEntry entry;
+        BOOST_CHECK_THROW(stream >> entry, std::ios_base::failure);
+        BOOST_CHECK(entry.vecTxOut.empty());
+    }
+}
+
 BOOST_AUTO_TEST_CASE(queue_timeout_bounds)
 {
     CCoinJoinQueue dsq;