From 685a808d73667c9d2384c832328709476fa1285d Mon Sep 17 00:00:00 2001
From: job <job@openbsd.org>
Date: Sat, 13 Jun 2026 19:16:14 +0000
Subject: [PATCH] Don't include ASPAs with too many providers in the CCR output

Reported by Ties de Kock

OK tb@
---
 usr.sbin/rpki-client/ccr.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/usr.sbin/rpki-client/ccr.c b/usr.sbin/rpki-client/ccr.c
index d0973f561a9..dd3c7234a1f 100644
--- a/usr.sbin/rpki-client/ccr.c
+++ b/usr.sbin/rpki-client/ccr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ccr.c,v 1.38 2026/05/18 16:26:41 tb Exp $ */
+/*	$OpenBSD: ccr.c,v 1.39 2026/06/13 19:16:14 job Exp $ */
 /*
  * Copyright (c) 2025 Job Snijders <job@openbsd.org>
  *
@@ -508,7 +508,9 @@ generate_aspapayloadstate(struct validation_data *vd)
 		errx(1, "ASPAPayloadState_new");
 
 	RB_FOREACH(vap, vap_tree, &vd->vaps) {
-		append_cached_aspa(vaps->aps, vap);
+		if (!vap->overflowed) {
+			append_cached_aspa(vaps->aps, vap);
+		}
 	}
 
 	hash_asn1_item(vaps->hash, ASN1_ITEM_rptr(ASPAPayloadSets), vaps->aps);