Merge pull request #10757

4f6652f net: cap aggregate ZMQ receive size (selsta)

ACKs: vtnerd, tobtoht

3 files changed, 10 insertions, 2 deletions

diff --git a/src/net/zmq.cpp b/src/net/zmq.cpp
index 2b3ca8376..4a9d3e162 100644
--- a/src/net/zmq.cpp
+++ b/src/net/zmq.cpp
@@ -150,6 +150,12 @@ namespace zmq
                     if ((last = zmq_msg_recv(part.handle(), socket, flags)) < 0)
                         return last;
 
+                    if (max_message_size < payload.size() ||
+                        max_message_size - payload.size() < part.size())
+                    {
+                        errno = EMSGSIZE;
+                        return -1;
+                    }
                     payload.append(part.data(), part.size());
                     if (!zmq_msg_more(part.handle()))
                         break;
diff --git a/src/net/zmq.h b/src/net/zmq.h
index 18bb80c8b..68b6a71be 100644
--- a/src/net/zmq.h
+++ b/src/net/zmq.h
@@ -64,6 +64,8 @@ namespace net
 {
 namespace zmq
 {
+    constexpr std::size_t max_message_size = 10 * 1024 * 1024; // 10 MiB
+
     //! \return Category for ZMQ errors.
     const std::error_category& error_category() noexcept;
 
diff --git a/src/rpc/zmq_server.cpp b/src/rpc/zmq_server.cpp
index 7ebb6c49f..3f1f38e21 100644
--- a/src/rpc/zmq_server.cpp
+++ b/src/rpc/zmq_server.cpp
@@ -46,7 +46,7 @@ namespace cryptonote
 namespace
 {
   constexpr const int num_zmq_threads = 1;
-  constexpr const std::int64_t max_message_size = 10 * 1024 * 1024; // 10 MiB
+  constexpr const std::int64_t max_frame_size = net::zmq::max_message_size;
   constexpr const std::chrono::seconds linger_timeout{2}; // wait period for pending out messages
 
   net::zmq::socket init_socket(void* context, int type, epee::span<const std::string> addresses)
@@ -62,7 +62,7 @@ namespace
       return nullptr;
     }
 
-    if (zmq_setsockopt(out.get(), ZMQ_MAXMSGSIZE, std::addressof(max_message_size), sizeof(max_message_size)) != 0)
+    if (zmq_setsockopt(out.get(), ZMQ_MAXMSGSIZE, std::addressof(max_frame_size), sizeof(max_frame_size)) != 0)
     {
       MONERO_LOG_ZMQ_ERROR("Failed to set maximum incoming message size");
       return nullptr;