merchant

commit f2c05486df2f4768876f970b68e01a970a67bf99
parent f5392553d32ca23be7b4c4238b1fa1546c242fc9
Author: Christian Grothoff <christian@grothoff.org>
Date:   Fri,  9 Oct 2026 23:50:18 +0200

do not abort on quantity overflow, just 400 it

Diffstat:
M
src/backend/taler-merchant-httpd_post-private-orders.c
 | 
26
++++++++++++++++++--------

1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_post-private-orders.c b/src/backend/taler-merchant-httpd_post-private-orders.c
@@ -3028,14 +3028,24 @@ phase_merge_inventory (struct OrderContext *oc)
             TALER_amount_set_zero (pd.price_array[j].currency,
                                    &atomic_amount));
           atomic_amount.fraction = 1;
-          GNUNET_assert (
-            GNUNET_OK ==
-            TALER_MERCHANT_amount_multiply_by_quantity (
-              &ps.prices[j],
-              &pd.price_array[j],
-              &ps.unit_quantity,
-              TALER_MERCHANT_ROUND_UP,
-              &atomic_amount));
+          if (GNUNET_OK !=
+              TALER_MERCHANT_amount_multiply_by_quantity (
+                &ps.prices[j],
+                &pd.price_array[j],
+                &ps.unit_quantity,
+                TALER_MERCHANT_ROUND_UP,
+                &atomic_amount))
+          {
+            /* the quantity is chosen by the client */
+            GNUNET_break_op (0);
+            GNUNET_free (ps.prices);
+            TALER_MERCHANTDB_product_details_free (&pd);
+            reply_with_error (oc,
+                              MHD_HTTP_BAD_REQUEST,
+                              TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                              "quantity");
+            return;
+          }
         }
 
         TALER_MERCHANT_vk_format_fractional_string (