donau

commit 53c3a289565a51c622c37bf0ffb5687f49a80eb5
parent 92ad5ac7167c3166478b15243182b653f2d6f430
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Fri, 17 Jul 2026 19:07:01 +0200

guard against OOB

Diffstat:
M
src/lib/donau_api_batch_issue_receipts.c
 | 
17
++++++++++++-----

1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/src/lib/donau_api_batch_issue_receipts.c b/src/lib/donau_api_batch_issue_receipts.c
@@ -120,6 +120,13 @@ handle_batch_issue_ok (const json_t *resp_obj,
   }
   biresp->details.ok.num_blinded_sigs
     = json_array_size (j_blind_signatures);
+  if (biresp->details.ok.num_blinded_sigs != birh->num_blinded_sigs)
+  {
+    /* The Donau must return exactly as many signatures as we requested;
+       anything else would make the array indexing below go out of bounds. */
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   biresp->details.ok.blinded_sigs =
     GNUNET_new_array (birh->num_blinded_sigs,
                       struct DONAU_BlindedDonationUnitSignature);
@@ -240,13 +247,13 @@ handle_batch_issue_finished (void *cls,
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;
-  // invalid charity signature
   case MHD_HTTP_FORBIDDEN:
+    // invalid charity signature
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;
-  // one or more donation units are not known to the Donau
   case MHD_HTTP_NOT_FOUND:
+    // one or more donation units are not known to the Donau
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;
@@ -254,18 +261,18 @@ handle_batch_issue_finished (void *cls,
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;
-  // Donation limit is not sufficient
   case MHD_HTTP_CONFLICT:
+    // Donation limit is not sufficient
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;
-  // donation unit key is no longer valid
   case MHD_HTTP_GONE:
+    // donation unit key is no longer valid
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;
-  // donation unit key is not yet valid
   case MHD_HTTP_TOO_EARLY:
+    // donation unit key is not yet valid
     biresp.hr.ec = TALER_JSON_get_error_code (j);
     biresp.hr.hint = TALER_JSON_get_error_hint (j);
     break;