Merge pull request #882

f11191a rpc: restrict number of fake outs requested in restricted rpc mode (moneromooo-monero)

1 files changed, 12 insertions, 0 deletions

diff --git a/src/rpc/core_rpc_server.cpp b/src/rpc/core_rpc_server.cpp
index cfe1057ac..ca18e7e09 100644
--- a/src/rpc/core_rpc_server.cpp
+++ b/src/rpc/core_rpc_server.cpp
@@ -41,6 +41,8 @@ using namespace epee;
 #include "crypto/hash.h"
 #include "core_rpc_server_error_codes.h"
 
+#define MAX_RESTRICTED_FAKE_OUTS_COUNT 40
+
 namespace cryptonote
 {
 
@@ -189,6 +191,16 @@ namespace cryptonote
   {
     CHECK_CORE_BUSY();
     res.status = "Failed";
+
+    if (m_restricted)
+    {
+      if (req.amounts.size() > 100 || req.outs_count > MAX_RESTRICTED_FAKE_OUTS_COUNT)
+      {
+        res.status = "Too many outs requested";
+        return true;
+      }
+    }
+
     if(!m_core.get_random_outs_for_amounts(req, res))
     {
       return true;