anastasis

commit 9969a86845d9706c80f8faa2f7a16836425fd5e7
parent 11209f481e3ded8d6803eeb6851be7b0344f2867
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 18:48:22 +0200

verify the account signature before allocating the upload buffer

Diffstat:
M
src/backend/anastasis-httpd_policy-upload.c
 | 
94
+++++++++++++++++++++++++++++++++++++++++--------------------------------------

1 file changed, 49 insertions(+), 45 deletions(-)
diff --git a/src/backend/anastasis-httpd_policy-upload.c b/src/backend/anastasis-httpd_policy-upload.c
@@ -725,51 +725,6 @@ AH_handler_policy_post (
           " header must include a base32-encoded value");
       }
     }
-    /* now setup 'puc' */
-    {
-      const char *lens;
-      unsigned long len;
-      char dummy;
-
-      lens = MHD_lookup_connection_value (connection,
-                                          MHD_HEADER_KIND,
-                                          MHD_HTTP_HEADER_CONTENT_LENGTH);
-      if ( (NULL == lens) ||
-           (1 != sscanf (lens,
-                         "%lu%c",
-                         &len,
-                         &dummy)) )
-      {
-        GNUNET_break_op (0);
-        return TALER_MHD_reply_with_error (
-          connection,
-          MHD_HTTP_BAD_REQUEST,
-          (NULL == lens)
-          ? TALER_EC_ANASTASIS_GENERIC_MISSING_CONTENT_LENGTH
-          : TALER_EC_ANASTASIS_GENERIC_MALFORMED_CONTENT_LENGTH,
-          NULL);
-      }
-      if (len / 1024 / 1024 >= AH_upload_limit_mb)
-      {
-        GNUNET_break_op (0);
-        return TALER_MHD_reply_with_error (connection,
-                                           MHD_HTTP_PAYLOAD_TOO_LARGE,
-                                           TALER_EC_SYNC_MALFORMED_CONTENT_LENGTH,
-                                           "Content-length value not acceptable");
-      }
-      puc->upload = GNUNET_malloc_large (len);
-      if (NULL == puc->upload)
-      {
-        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
-                             "malloc");
-        return TALER_MHD_reply_with_error (connection,
-                                           MHD_HTTP_PAYLOAD_TOO_LARGE,
-                                           TALER_EC_ANASTASIS_POLICY_OUT_OF_MEMORY_ON_CONTENT_LENGTH,
-                                           NULL);
-      }
-      puc->upload_size = (size_t) len;
-    }
-
     TALER_MHD_parse_request_header_auto_t (connection,
                                            ANASTASIS_HTTP_HEADER_POLICY_SIGNATURE,
                                            &puc->account_sig);
@@ -821,6 +776,55 @@ AH_handler_policy_post (
       }
     }
 
+    /* Only now, with the account signature verified, do we allocate the
+       upload buffer: sizing it from the client-declared Content-Length before
+       checking who is asking lets anyone force repeated multi-megabyte
+       allocations. */
+    /* now setup 'puc' */
+    {
+      const char *lens;
+      unsigned long len;
+      char dummy;
+
+      lens = MHD_lookup_connection_value (connection,
+                                          MHD_HEADER_KIND,
+                                          MHD_HTTP_HEADER_CONTENT_LENGTH);
+      if ( (NULL == lens) ||
+           (1 != sscanf (lens,
+                         "%lu%c",
+                         &len,
+                         &dummy)) )
+      {
+        GNUNET_break_op (0);
+        return TALER_MHD_reply_with_error (
+          connection,
+          MHD_HTTP_BAD_REQUEST,
+          (NULL == lens)
+          ? TALER_EC_ANASTASIS_GENERIC_MISSING_CONTENT_LENGTH
+          : TALER_EC_ANASTASIS_GENERIC_MALFORMED_CONTENT_LENGTH,
+          NULL);
+      }
+      if (len / 1024 / 1024 >= AH_upload_limit_mb)
+      {
+        GNUNET_break_op (0);
+        return TALER_MHD_reply_with_error (connection,
+                                           MHD_HTTP_PAYLOAD_TOO_LARGE,
+                                           TALER_EC_SYNC_MALFORMED_CONTENT_LENGTH,
+                                           "Content-length value not acceptable");
+      }
+      puc->upload = GNUNET_malloc_large (len);
+      if (NULL == puc->upload)
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                             "malloc");
+        return TALER_MHD_reply_with_error (connection,
+                                           MHD_HTTP_PAYLOAD_TOO_LARGE,
+                                           TALER_EC_ANASTASIS_POLICY_OUT_OF_MEMORY_ON_CONTENT_LENGTH,
+                                           NULL);
+      }
+      puc->upload_size = (size_t) len;
+    }
+
     puc->timeout = GNUNET_TIME_relative_to_absolute (
       CHECK_PAYMENT_GENERIC_TIMEOUT);
     TALER_MHD_parse_request_timeout (connection,