A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.
该报告还没有中文解读。
原文摘录
摘自原文（4956 字符中的一小部分）
The pending block queue holds the blocks that we have downloaded but have yet to verify, because of a few lax rules in the synchronization code it's possible to fill this queue past the limit. My PoC could get the queue to ~54 GB, slightly larger would be possible with slight modifications. I …
原文中的代码
bool stripe_proceed_main =
(
(m_sync_pruned_blocks && local_stripe && add_stripe != local_stripe) // True if we should sync pruned blocks, we are pruned and the peer has the next blocks pruned.
|| add_stripe == 0 // True if the next block is within the tip-blocks which won't be …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Monero 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @boog900 · 版权归作者与 Monero 所有