diff --git a/src/net_processing.cpp b/src/net_processing.cpp index d99bcc71a399..7fb71fc3e4aa 100644 --- a/src/net_processing.cpp +++ b/src/net_processing.cpp @@ -4729,7 +4729,7 @@ void PeerManagerImpl::ProcessMessage( // DoS prevention: do not allow m_orphans to grow unbounded (see CVE-2012-3789) unsigned int nMaxOrphanTxSize = (unsigned int)std::max((int64_t)0, gArgs.GetIntArg("-maxorphantxsize", DEFAULT_MAX_ORPHAN_TRANSACTIONS_SIZE)) * 1000000; - m_orphanage.LimitOrphans(nMaxOrphanTxSize); + m_orphanage.LimitOrphans(nMaxOrphanTxSize, m_rng); } else { LogPrint(BCLog::MEMPOOL, "not keeping orphan with rejected parents %s\n",tx.GetHash().ToString()); // We will continue to reject this tx since it has rejected diff --git a/src/test/fuzz/txorphan.cpp b/src/test/fuzz/txorphan.cpp index 17709d9f72f4..93619a9fa821 100644 --- a/src/test/fuzz/txorphan.cpp +++ b/src/test/fuzz/txorphan.cpp @@ -36,6 +36,7 @@ void initialize_orphanage() FUZZ_TARGET(txorphan, .init = initialize_orphanage) { FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); + FastRandomContext limit_orphans_rng{/*fDeterministic=*/true}; SetMockTime(ConsumeTime(fuzzed_data_provider)); TxOrphanage orphanage; @@ -140,7 +141,7 @@ FUZZ_TARGET(txorphan, .init = initialize_orphanage) // test mocktime and expiry SetMockTime(ConsumeTime(fuzzed_data_provider)); auto limit = fuzzed_data_provider.ConsumeIntegral(); - orphanage.LimitOrphans(limit); + orphanage.LimitOrphans(limit, limit_orphans_rng); Assert(orphanage.Size() <= limit); }); } diff --git a/src/test/orphanage_tests.cpp b/src/test/orphanage_tests.cpp index 99c0503790c7..259238fa5255 100644 --- a/src/test/orphanage_tests.cpp +++ b/src/test/orphanage_tests.cpp @@ -127,11 +127,12 @@ BOOST_AUTO_TEST_CASE(DoS_mapOrphans) } // Test LimitOrphanTxSize() function: - orphanage.LimitOrphans(40); + FastRandomContext rng{/*fDeterministic=*/true}; + orphanage.LimitOrphans(40, rng); BOOST_CHECK(orphanage.CountOrphans() <= 40); - orphanage.LimitOrphans(10); + orphanage.LimitOrphans(10, rng); BOOST_CHECK(orphanage.CountOrphans() <= 10); - orphanage.LimitOrphans(0); + orphanage.LimitOrphans(0, rng); BOOST_CHECK(orphanage.CountOrphans() == 0); } diff --git a/src/txorphanage.cpp b/src/txorphanage.cpp index d03924c2fe7d..ea2c818239a0 100644 --- a/src/txorphanage.cpp +++ b/src/txorphanage.cpp @@ -116,7 +116,7 @@ void TxOrphanage::EraseForPeer(NodeId peer) if (nErased > 0) LogPrint(BCLog::MEMPOOL, "Erased %d orphan tx from peer=%d\n", nErased, peer); } -void TxOrphanage::LimitOrphans(unsigned int max_orphans_size) +void TxOrphanage::LimitOrphans(unsigned int max_orphans_size, FastRandomContext& rng) { LOCK(m_mutex); diff --git a/src/txorphanage.h b/src/txorphanage.h index bd68ea091627..618da0e6918a 100644 --- a/src/txorphanage.h +++ b/src/txorphanage.h @@ -51,7 +51,7 @@ class TxOrphanage { bool HaveMoreWork(NodeId peer) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex); /** Limit the orphanage to the given maximum */ - void LimitOrphans(unsigned int max_orphans_size) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex); + void LimitOrphans(unsigned int max_orphans_size, FastRandomContext& rng) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex); /** Add any orphans that list a particular tx as a parent into a peer's work set */ void AddChildrenToWorkSet(const CTransaction& tx, NodeId peer) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);