Merge pull request #276 from matrix-org/kegan/cbor-max-keys

Increase the number of user IDs allowed in device list changes
matrix-org · Aug 29, 2023 · 195c52f · 195c52f
2 parents 3ce665d + 008ffb8
commit 195c52f
Showing 1 changed file with 16 additions and 2 deletions.
diff --git a/state/device_data_table.go b/state/device_data_table.go
@@ -55,7 +55,14 @@ func (t *DeviceDataTable) Select(userID, deviceID string, swap bool) (result *in
 			return err
 		}
 		// unmarshal to swap
-		if err = cbor.Unmarshal(row.Data, &result); err != nil {
+		opts := cbor.DecOptions{
+			MaxMapPairs: 1000000000, // 1 billion :(
+		}
+		decMode, err := opts.DecMode()
+		if err != nil {
+			return err
+		}
+		if err = decMode.Unmarshal(row.Data, &result); err != nil {
 			return err
 		}
 		result.UserID = userID
@@ -104,7 +111,14 @@ func (t *DeviceDataTable) Upsert(dd *internal.DeviceData) (err error) {
 		// unmarshal and combine
 		var tempDD internal.DeviceData
 		if len(row.Data) > 0 {
-			if err = cbor.Unmarshal(row.Data, &tempDD); err != nil {
+			opts := cbor.DecOptions{
+				MaxMapPairs: 1000000000, // 1 billion :(
+			}
+			decMode, err := opts.DecMode()
+			if err != nil {
+				return err
+			}
+			if err = decMode.Unmarshal(row.Data, &tempDD); err != nil {
 				return err
 			}
 		}