merchant

commit 96bee3da047753d35456d6ed6782270efaa90181
parent 336fb2be8705f1550a308cf667a2794d81ddb601
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Fri, 10 Jul 2026 09:07:12 +0200

check num_coins better

Diffstat:
M
src/lib/merchant_api_post-orders-ORDER_ID-abort.c
 | 
7
++++++-

1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/lib/merchant_api_post-orders-ORDER_ID-abort.c b/src/lib/merchant_api_post-orders-ORDER_ID-abort.c
@@ -141,7 +141,7 @@ check_abort_refund (struct TALER_MERCHANT_PostOrdersAbortHandle *poah,
   }
   num_refunds = (unsigned int) json_array_size (refunds);
   if ( (json_array_size (refunds) != (size_t) num_refunds) ||
-       (num_refunds > MAX_REFUNDS) )
+       (num_refunds != poah->num_coins) )
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -388,6 +388,11 @@ TALER_MERCHANT_post_orders_abort_create (
 {
   struct TALER_MERCHANT_PostOrdersAbortHandle *poah;
 
+  if (MAX_REFUNDS > num_coins)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   poah = GNUNET_new (struct TALER_MERCHANT_PostOrdersAbortHandle);
   poah->ctx = ctx;
   poah->base_url = GNUNET_strdup (url);