anastasis

commit 5f4f65aa31a8d8a410d7c78cff4e1c210415df47
parent daaa90077fa1040d486fdb3554f10c2ea9902533
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 15:24:20 +0200

do not fail if client provides inconsistent content-length AND chunked encoding

Diffstat:
M
src/backend/anastasis-httpd_policy-upload.c
 | 
18
++++++++++++++++--

1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/src/backend/anastasis-httpd_policy-upload.c b/src/backend/anastasis-httpd_policy-upload.c
@@ -1098,8 +1098,22 @@ AH_handler_policy_post (
   /* handle upload */
   if (0 != *recovery_data_size)
   {
-    /* check MHD invariant */
-    GNUNET_assert (puc->upload_off + *recovery_data_size <= puc->upload_size);
+    /* This is NOT an MHD invariant we may assume: with the default client
+       discipline MHD accepts a request carrying both a "Content-Length" and
+       "Transfer-Encoding: chunked", ignores the former for framing (but keeps
+       it retrievable, which is where puc->upload_size came from) and then
+       hands us however many bytes the chunked body actually contains.  So a
+       client can send more than it declared; refuse it rather than write past
+       the end of the buffer. */
+    if (puc->upload_off + *recovery_data_size > puc->upload_size)
+    {
+      GNUNET_break_op (0);
+      return TALER_MHD_reply_with_error (
+        connection,
+        MHD_HTTP_BAD_REQUEST,
+        TALER_EC_ANASTASIS_GENERIC_MALFORMED_CONTENT_LENGTH,
+        "upload is larger than the declared content length");
+    }
     memcpy (&puc->upload[puc->upload_off],
             recovery_data,
             *recovery_data_size);