fix: reject oversized payout arrays in rpc

Author: PastaPastaPasta

src/rpc/evo.cpp

@@ -282,6 +282,9 @@ static MasternodePayoutShares ParsePayouts(const UniValue& value, const std::str
         if (arr.empty()) {
             throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("%s must contain at least one entry", paramName));
         }
+        if (arr.size() > 8) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("%s must not contain more than 8 entries", paramName));
+        }
         for (size_t i = 0; i < arr.size(); ++i) {
             const UniValue& entry = arr[i];
             if (!entry.isObject()) {

test/functional/feature_masternode_payout_shares.py

@@ -83,6 +83,7 @@ def run_test(self):
             {"address": payout1, "reward": 7000},
             {"address": payout2, "reward": 3000},
         ]
+        oversized_payouts = [{"address": node.getnewaddress(), "reward": 1000} for _ in range(9)]
 
         collateral_txid = node.sendmany("", {mn.collateral_address: mn.get_collateral_value(), mn.fundsAddr: 1})
         self.bump_mocktime(10 * 60 + 1)
@@ -103,6 +104,19 @@ def run_test(self):
             expected_assert_msg="payouts must contain at least one entry",
         )
 
+        mn.register(
+            node,
+            submit=True,
+            collateral_txid=mn.collateral_txid,
+            collateral_vout=mn.collateral_vout,
+            addrs_core_p2p=[f"127.0.0.1:{mn.nodePort}"],
+            operator_reward=0,
+            payouts=oversized_payouts,
+            fundsAddr=mn.fundsAddr,
+            expected_assert_code=-8,
+            expected_assert_msg="payouts must not contain more than 8 entries",
+        )
+
         protx_hash = mn.register(
             node,
             submit=True,
@@ -137,6 +151,15 @@ def run_test(self):
             expected_assert_msg="payouts must contain at least one entry",
         )
 
+        mn.update_registrar(
+            node,
+            submit=True,
+            payouts=oversized_payouts,
+            fundsAddr=mn.fundsAddr,
+            expected_assert_code=-8,
+            expected_assert_msg="payouts must not contain more than 8 entries",
+        )
+
         gbt_payees = [p for p in node.getblocktemplate()["masternode"] if p["script"] != "6a"]
         assert_equal(len(gbt_payees), 2)
         assert_equal(gbt_payees[0]["payee"], payout1)