From 2f733a5025ec161112ae67f51ef2903819ad3917 Mon Sep 17 00:00:00 2001
From: Levi Neely <141506390+lneely@users.noreply.github.com>
Date: Tue, 3 Mar 2026 15:10:27 +0100
Subject: [PATCH] Add MAX_API_RESPONSE_SIZE bounds check in papi.c (#315)

API calls tested and working
---
 pclsync/papi.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pclsync/papi.c b/pclsync/papi.c
index e466fa6..88ddb45 100644
--- a/pclsync/papi.c
+++ b/pclsync/papi.c
@@ -28,6 +28,8 @@
 */
 
 #include <stddef.h>
+
+#define MAX_API_RESPONSE_SIZE (256 * 1024 * 1024) // 256MB
 #include <stdio.h>
 #include <string.h>
 
@@ -396,6 +398,12 @@ binresult *papi_result(psock_t *sock) {
     return NULL;
   }
 
+  if (ressize > MAX_API_RESPONSE_SIZE) {
+    pdbg_logf(D_WARNING, "API response size %u exceeds limit %u, rejecting",
+              ressize, MAX_API_RESPONSE_SIZE);
+    return NULL;
+  }
+
   data = (unsigned char *)malloc(ressize);
 
   if (pdbg_unlikely(psock_readall(sock, data, ressize) != ressize)) {