anastasis

commit 06b780b5c0eb1ff1cc594defcede5a429044dd1d
parent 9f2bca9fe7cd211063f03948f3efb523edc96076
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 16:51:33 +0200

check the json_pack result before creating a payment order

Diffstat:
M
src/backend/anastasis-httpd_policy-upload.c
 | 
11
+++++++++++
M
src/backend/anastasis-httpd_truth-upload.c
 | 
9
+++++++++

2 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/src/backend/anastasis-httpd_policy-upload.c b/src/backend/anastasis-httpd_policy-upload.c
@@ -611,6 +611,17 @@ begin_payment (struct PolicyUploadContext *puc)
                        "unit", "years",
                        "order_id", order_id);
     GNUNET_free (order_id);
+    if (NULL == order)
+    {
+      GNUNET_break (0);
+      GNUNET_CONTAINER_DLL_remove (puc_head,
+                                   puc_tail,
+                                   puc);
+      return TALER_MHD_reply_with_error (puc->con,
+                                         MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                         TALER_EC_GENERIC_JSON_ALLOCATION_FAILURE,
+                                         "could not create order");
+    }
   }
   MHD_suspend_connection (puc->con);
   puc->po = TALER_MERCHANT_post_private_orders_create (AH_ctx,
diff --git a/src/backend/anastasis-httpd_truth-upload.c b/src/backend/anastasis-httpd_truth-upload.c
@@ -423,6 +423,15 @@ check_payment_cb (struct TruthUploadContext *tuc,
                          "order_id",
                          order_id);
       GNUNET_free (order_id);
+      if (NULL == order)
+      {
+        GNUNET_break (0);
+        tuc->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+        tuc->resp = TALER_MHD_make_error (
+          TALER_EC_GENERIC_JSON_ALLOCATION_FAILURE,
+          "could not create order");
+        break;
+      }
       tuc->po = TALER_MERCHANT_post_private_orders_create (AH_ctx,
                                                            AH_backend_url,
                                                            order);