donau

commit e1aa1d9d6815765766bde8a4c2955cd9f9587376
parent 43bfbe26b531977267d99ef577b3fdcf752c3093
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Fri, 17 Jul 2026 19:21:45 +0200

bound length of VLA arrays to sane limit

Diffstat:
M
src/donau/donau-httpd_post-batch-issue-CHARITY_ID.c
 | 
5
++++-
M
src/donau/donau-httpd_post-batch-submit.c
 | 
5
++++-

2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/donau/donau-httpd_post-batch-issue-CHARITY_ID.c b/src/donau/donau-httpd_post-batch-issue-CHARITY_ID.c
@@ -174,7 +174,10 @@ DH_handler_post_batch_issue (struct DH_RequestContext *rc,
 
   /* parse the budikeypairs array */
   num_bkps = json_array_size (budikeypairs);
-  if (0 == num_bkps)
+  /* Bound the request-controlled count: du_sigs[]/bkps_sign_data[] below are
+     stack-allocated VLAs of this size. */
+  if ( (0 == num_bkps) ||
+       (num_bkps > 1024) )
   {
     GNUNET_break_op (0);
     return TALER_MHD_reply_with_error (rc->connection,
diff --git a/src/donau/donau-httpd_post-batch-submit.c b/src/donau/donau-httpd_post-batch-submit.c
@@ -130,7 +130,10 @@ DH_handler_post_batch_submit (struct DH_RequestContext *rc,
   /* parse the donation receipts */
   num_dr = json_array_size (donation_receipts);
 
-  if (0 == num_dr)
+  /* Bound the request-controlled count: the nonce-uniqueness check below is
+     O(num_dr^2). */
+  if ( (0 == num_dr) ||
+       (num_dr > 1024) )
   {
     GNUNET_break_op (0);
     return TALER_MHD_reply_with_error (rc->connection,