exchange

commit b35701a95bd9f439c32e559baa4d679eb5676fca
parent 10d9aa40ccd25d45a0779cf7625dc8fa0e634176
Author: Christian Grothoff <christian@grothoff.org>
Date:   Thu, 13 Aug 2026 20:04:33 +0200

limit excessive upload sizes

Diffstat:
M
src/exchange/taler-exchange-httpd_post-management-keys.c
 | 
28
++++++++++++++++++++++++++++

1 file changed, 28 insertions(+), 0 deletions(-)
diff --git a/src/exchange/taler-exchange-httpd_post-management-keys.c b/src/exchange/taler-exchange-httpd_post-management-keys.c
@@ -36,6 +36,18 @@
 
 
 /**
+ * Maximum number of entries we accept in the "denom_sigs" and in the
+ * "signkey_sigs" array of a single request.  The offline signing tool
+ * uploads one entry per future key the security modules pre-generated,
+ * that is (LOOKAHEAD_SIGN / DURATION_WITHDRAW) entries per configured
+ * denomination; this bound is far above what any realistic rotation
+ * schedule yields, while keeping the memory allocated for a request in
+ * the same order of magnitude as the request body itself.
+ */
+#define MAX_KEY_SIGS 16384
+
+
+/**
  * Denomination signature provided.
  */
 struct DenomSig
@@ -396,6 +408,22 @@ TEH_handler_management_post_keys (
     if (GNUNET_NO == res)
       return MHD_YES; /* failure */
   }
+  if (json_array_size (denom_sigs) > MAX_KEY_SIGS)
+  {
+    GNUNET_break_op (0);
+    return TALER_MHD_reply_with_error (connection,
+                                       MHD_HTTP_BAD_REQUEST,
+                                       TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                                       "denom_sigs");
+  }
+  if (json_array_size (signkey_sigs) > MAX_KEY_SIGS)
+  {
+    GNUNET_break_op (0);
+    return TALER_MHD_reply_with_error (connection,
+                                       MHD_HTTP_BAD_REQUEST,
+                                       TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                                       "signkey_sigs");
+  }
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "Received POST /management/keys request\n");