merchant

commit c50f08ddd051b165012c9b331eb34acc5c03a828
parent b197310f22dc2cf2324ed6cb8c5e86d24cc30d9b
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Mon, 20 Jul 2026 09:17:17 +0200

guard against UINT_MAX overflow

Diffstat:
M
src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c
 | 
17
+++++++++++++++++

1 file changed, 17 insertions(+), 0 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c b/src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c
@@ -925,6 +925,23 @@ verify_using_templates_inventory (struct UseContext *uc)
                             "price_array");
       return GNUNET_SYSERR;
     }
+
+    /* The line-total computation multiplies the unit price by the
+       integer quantity using TALER_amount_multiply(), whose factor
+       argument is only a uint32_t.  A quantity that does not fit into
+       32 bits would be silently truncated by the (uint32_t) cast in
+       compute_line_total() (e.g. quantity == 2^32 truncates to 0),
+       producing a wrong -- and attacker-controllable, much too low --
+       price.  Reject such quantities rather than truncate them. */
+    if (item->quantity_value > UINT32_MAX)
+    {
+      GNUNET_break_op (0);
+      use_reply_with_error (uc,
+                            MHD_HTTP_BAD_REQUEST,
+                            TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                            "unit_quantity");
+      return GNUNET_SYSERR;
+    }
   }
 
   for (unsigned int i = 0;