fix: bound CoinJoin entry intake

CCoinJoinEntry deserialized its input and output vectors with the unbounded
operator>>. Replace the SERIALIZE_METHODS with an explicit reader that bounds
both vectors via the shared UnserializeVectorWithMaxSize() before allocating,
while preserving the collateral-penalty behavior AddEntry relies on:

- max+1 collateral penalty: accept one input over COINJOIN_ENTRY_MAX_SIZE so
  AddEntry can still charge the collateral for an entry that is merely too
  large; a count beyond that is rejected before any element is decoded.

- txCollateral / fHasOversizedTxOut invariant: outputs follow txCollateral on
  the wire, so an oversized output count must not throw mid-entry. Set
  fHasOversizedTxOut and leave txCollateral intact so AddEntry can reject the
  entry with ERR_MAXIMUM and consume its collateral.

Counts above the generic MAX_SIZE cap are not a CoinJoin-level violation but a
malformed message, and still throw from ReadCompactSize as they do for any
other network message. fHasOversizedTxOut is cleared at the start of
Unserialize, so a half-read entry can never reach AddEntry's collateral path.

Addresses review thread discussion_r3556209431.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: thepastaclaw

src/coinjoin/coinjoin.h

@@ -13,6 +13,7 @@
 #include <netaddress.h>
 #include <primitives/block.h>
 #include <primitives/transaction.h>
+#include <serialize.h>
 #include <sync.h>
 #include <timedata.h>
 #include <util/translation.h>
@@ -154,6 +155,7 @@ class CCoinJoinEntry
     CTransactionRef txCollateral;
     // memory only
     CService addr;
+    bool fHasOversizedTxOut{false};
 
     CCoinJoinEntry() :
         txCollateral(MakeTransactionRef(CMutableTransaction{}))
@@ -167,9 +169,34 @@ class CCoinJoinEntry
     {
     }
 
-    SERIALIZE_METHODS(CCoinJoinEntry, obj)
+    template <typename Stream>
+    void Serialize(Stream& s) const
     {
-        READWRITE(obj.vecTxDSIn, obj.txCollateral, obj.vecTxOut);
+        s << vecTxDSIn << txCollateral << vecTxOut;
+    }
+
+    template <typename Stream>
+    void Unserialize(Stream& s)
+    {
+        fHasOversizedTxOut = false;
+
+        // Accept one input over the cap so AddEntry can apply the collateral
+        // penalty for an entry that is merely too large; anything bigger is
+        // rejected before any element is decoded.
+        if (!UnserializeVectorWithMaxSize(s, vecTxDSIn, COINJOIN_ENTRY_MAX_SIZE + 1)) {
+            throw std::ios_base::failure("CCoinJoinEntry::vecTxDSIn size too large");
+        }
+
+        s >> txCollateral;
+
+        if (!UnserializeVectorWithMaxSize(s, vecTxOut, COINJOIN_ENTRY_MAX_SIZE)) {
+            // Outputs follow txCollateral on the wire, so an output count over the
+            // cap must not throw mid-entry: flag it and leave txCollateral intact
+            // so AddEntry can reject the entry with ERR_MAXIMUM and consume its
+            // collateral. A count above the generic MAX_SIZE cap is malformed and
+            // still throws from ReadCompactSize.
+            fHasOversizedTxOut = true;
+        }
     }
 
     bool AddScriptSig(const CTxIn& txin);

src/coinjoin/server.cpp

@@ -610,6 +610,27 @@ bool CCoinJoinServer::AddEntry(const CCoinJoinEntry& entry, PoolMessage& nMessag
         return false;
     }
 
+    if (entry.fHasOversizedTxOut || entry.vecTxOut.size() > COINJOIN_ENTRY_MAX_SIZE) {
+        const size_t txout_size{entry.fHasOversizedTxOut ? COINJOIN_ENTRY_MAX_SIZE + 1 : entry.vecTxOut.size()};
+        LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: too many outputs! %d/%d\n", __func__,
+                 static_cast<int>(txout_size), static_cast<int>(COINJOIN_ENTRY_MAX_SIZE));
+        nMessageIDRet = ERR_MAXIMUM;
+        CTransactionRef txCollateralToConsume;
+        {
+            LOCK(cs_coinjoin);
+            const auto it = std::ranges::find_if(vecSessionCollaterals, [&entry](const auto& txCollateral) {
+                return *entry.txCollateral == *txCollateral;
+            });
+            if (it != vecSessionCollaterals.end()) {
+                txCollateralToConsume = *it;
+            }
+        }
+        if (txCollateralToConsume) {
+            ConsumeCollateral(txCollateralToConsume);
+        }
+        return false;
+    }
+
     if (!CoinJoin::IsCollateralValid(m_chainman, m_isman, mempool, *entry.txCollateral)) {
         LogPrint(BCLog::COINJOIN, "CCoinJoinServer::%s -- ERROR: collateral not valid!\n", __func__);
         nMessageIDRet = ERR_INVALID_COLLATERAL;

src/test/coinjoin_inouts_tests.cpp

@@ -287,6 +287,76 @@ BOOST_AUTO_TEST_CASE(server_signfinaltx_participant_oversized_count_is_rejected_
     BOOST_CHECK_EQUAL(server.GetEntriesCount(), 1);
 }
 
+BOOST_AUTO_TEST_CASE(entry_allows_one_oversized_input_for_collateral_penalty)
+{
+    CCoinJoinEntry oversized_entry;
+    oversized_entry.vecTxDSIn.resize(COINJOIN_ENTRY_MAX_SIZE + 1);
+
+    CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+    stream << oversized_entry;
+
+    CCoinJoinEntry entry;
+    BOOST_CHECK_NO_THROW(stream >> entry);
+    BOOST_CHECK_EQUAL(entry.vecTxDSIn.size(), COINJOIN_ENTRY_MAX_SIZE + 1);
+    BOOST_CHECK(entry.vecTxOut.empty());
+}
+
+BOOST_AUTO_TEST_CASE(entry_rejects_huge_inputs_before_materializing)
+{
+    CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+    WriteCompactSize(stream, COINJOIN_ENTRY_MAX_SIZE + 2);
+
+    CCoinJoinEntry entry;
+    BOOST_CHECK_THROW(stream >> entry, std::ios_base::failure);
+    BOOST_CHECK(entry.vecTxDSIn.empty());
+}
+
+BOOST_AUTO_TEST_CASE(entry_flags_oversized_outputs_before_materializing)
+{
+    CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+    WriteCompactSize(stream, 0);
+    stream << MakeTransactionRef(CMutableTransaction{});
+    WriteCompactSize(stream, COINJOIN_ENTRY_MAX_SIZE + 1);
+
+    CCoinJoinEntry entry;
+    BOOST_CHECK_NO_THROW(stream >> entry);
+    BOOST_CHECK(entry.fHasOversizedTxOut);
+    BOOST_CHECK(entry.vecTxOut.empty());
+}
+
+BOOST_AUTO_TEST_CASE(entry_throws_on_huge_outputs_before_materializing)
+{
+    CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+    WriteCompactSize(stream, 0);
+    stream << MakeTransactionRef(CMutableTransaction{});
+    WriteCompactSize(stream, MAX_SIZE + 1);
+
+    // Above the generic CompactSize cap the message is simply malformed, so the
+    // standard deserialization error is raised. No output is materialized, and the
+    // half-read entry is not left looking like an oversized-but-chargeable one:
+    // fHasOversizedTxOut stays clear, so it cannot reach AddEntry's collateral path.
+    CCoinJoinEntry entry;
+    BOOST_CHECK_THROW(stream >> entry, std::ios_base::failure);
+    BOOST_CHECK(!entry.fHasOversizedTxOut);
+    BOOST_CHECK(entry.vecTxOut.empty());
+}
+
+BOOST_AUTO_TEST_CASE(entry_accepts_max_sized_vectors)
+{
+    CCoinJoinEntry entry;
+    entry.vecTxDSIn.resize(COINJOIN_ENTRY_MAX_SIZE); // exactly the cap must be accepted
+    entry.vecTxOut.resize(COINJOIN_ENTRY_MAX_SIZE);
+
+    CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
+    stream << entry;
+
+    CCoinJoinEntry roundtripped;
+    BOOST_CHECK_NO_THROW(stream >> roundtripped);
+    BOOST_CHECK_EQUAL(roundtripped.vecTxDSIn.size(), COINJOIN_ENTRY_MAX_SIZE);
+    BOOST_CHECK_EQUAL(roundtripped.vecTxOut.size(), COINJOIN_ENTRY_MAX_SIZE);
+    BOOST_CHECK(!roundtripped.fHasOversizedTxOut);
+}
+
 BOOST_AUTO_TEST_CASE(queue_timeout_bounds)
 {
     CCoinJoinQueue dsq;