Tor relay denial of service

From https://lists.torproject.org/pipermail/tor-talk/2012-May/024328.html:

I found a strange behavior in Tor relays that allow me to make a remote Tor relay crash or at least have a 100 % CPU usage. It crashes only if it is possible to send more data than RAM (and swap) can store in 300 s (5 minutes) to the relay.

Proof of concept attached to this ticket. I have not tested this myself.