From 853c9973775496a20dbc709149bc943f4e0bf464 Mon Sep 17 00:00:00 2001 From: jholdstock Date: Sun, 19 Apr 2026 10:12:26 +0800 Subject: [PATCH] client: Limit reads. An honest vspd should never return responses greater than 4MB. --- client/client.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/client/client.go b/client/client.go index 875c298d..5b86e13f 100644 --- a/client/client.go +++ b/client/client.go @@ -1,4 +1,4 @@ -// Copyright (c) 2022-2025 The Decred developers +// Copyright (c) 2022-2026 The Decred developers // Use of this source code is governed by an ISC // license that can be found in the LICENSE file. @@ -210,7 +210,7 @@ func (c *Client) do(ctx context.Context, method, path string, addr stdaddr.Addre } } - respBody, err := io.ReadAll(reply.Body) + respBody, err := io.ReadAll(io.LimitReader(reply.Body, 1<<22)) // 4 MiB limit if err != nil { return fmt.Errorf("read response body: %w", err) }