merchant

commit 8c52d25123a2551794b769d5afc6e08c842b0fb7
parent 0641151f6d83a013170fbc6c5282c59731d0057c
Author: Christian Grothoff <christian@grothoff.org>
Date:   Sat, 10 Oct 2026 15:01:48 +0200

limit choice_amounts array length

Diffstat:
M
src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c
 | 
18
++++++++++++++++++

1 file changed, 18 insertions(+), 0 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c b/src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c
@@ -47,6 +47,15 @@
 
 
 /**
+ * Maximum number of entries we accept in the @e choice_amounts array of
+ * a request.  The uniqueness check over the array is quadratic, and the
+ * array is parsed before we even know the template, so this must be
+ * bounded independently of the maximum upload size.
+ */
+#define MAX_CHOICE_AMOUNTS 1024
+
+
+/**
  * Amount the client chose for one of the choices of a paivana template.
  */
 struct PaivanaChoiceAmount
@@ -583,6 +592,15 @@ parse_using_templates_paivana_request (
         "amount and choice_amounts are mutually exclusive");
       return GNUNET_SYSERR;
     }
+    if (MAX_CHOICE_AMOUNTS < json_array_size (choice_amounts))
+    {
+      GNUNET_break_op (0);
+      use_reply_with_error (uc,
+                            MHD_HTTP_BAD_REQUEST,
+                            TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                            "choice_amounts (too many entries)");
+      return GNUNET_SYSERR;
+    }
     for (size_t i = 0; i < json_array_size (choice_amounts); i++)
     {
       struct PaivanaChoiceAmount ca;