I'm surveying old Bitcoin DoS vectors and came across CVE-2013-4267, for which there appears to be little public information available. This thread should shed some light on this CVE.
There's a description in this blog post:
Transactions are also first deserialized in order to be parsed, but they are stored “as is” in a temporary cache called MapRelay, and forwarded without being serialized again. I really don’t know why this is done. But the point is that the storage of messages as they are received leads to the possibility that an attacker creates messages much bigger than the actual transaction object contained, which, when stored in MapRelay memory, can be used to exhaust the memory of a node.
There is also this relevant thread which appears to say the network was under attack using this vector.
Based on the transaction serialization and deserialization code in ~v0.8.2, it looks like the attack may have been: add large amount of random data at the end of a valid serialized transaction. The deserializer finds what it looks for (the valid blob prefix), but appears to ignore what comes after. If a serialized transaction with random data at the end of the transaction is sent to the victim node, it will be deserialized, passed to the mem-pool and then placed in mapRelay in its full size (and then possibly forwarded further, which seems like a pretty powerful attack vector).
So: was the attack described by CVE-2013-4267 based on adding random data at the end of (valid) serialized transaction data?
