anastasis

commit 41076924349fb315340a9aaadf02d7baabab004b
parent c27ad69b09a218d163ace2d29ad4093fc9d86478
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 13:08:05 +0200

restclient: bound the provider-supplied methods array before the VLA

Diffstat:
M
src/restclient/anastasis_api_config.c
 | 
9
+++++++++

1 file changed, 9 insertions(+), 0 deletions(-)
diff --git a/src/restclient/anastasis_api_config.c b/src/restclient/anastasis_api_config.c
@@ -178,6 +178,15 @@ handle_config_finished (void *cls,
         acfg.ec = TALER_EC_GENERIC_REPLY_MALFORMED;
         break;
       }
+      /* Bound the array so a malicious provider cannot force an unbounded
+         stack VLA (a ~40 MB response could otherwise yield ~10^6 elements). */
+      if (acfg.details.ok.methods_length > 1024)
+      {
+        GNUNET_break_op (0);
+        acfg.http_status = 0;
+        acfg.ec = TALER_EC_GENERIC_REPLY_MALFORMED;
+        break;
+      }
       {
         struct ANASTASIS_AuthorizationMethodConfig mcfg[
           GNUNET_NZL (acfg.details.ok.methods_length)];