address: add MaxEventQueryLimit validation

Author: darioAnongba

address/event.go

@@ -57,6 +57,10 @@ const (
 	// DefaultEventQueryLimit is the number of events returned
 	// when no limit is provided.
 	DefaultEventQueryLimit = 512
+
+	// MaxEventQueryLimit is the maximum number of events that can be
+	// returned in a single query.
+	MaxEventQueryLimit = 16384
 )
 
 // EventQueryParams holds the set of query params for address events.

rpcserver.go

@@ -2230,6 +2230,10 @@ func (r *rpcServer) AddrReceives(ctx context.Context,
 	if req.Limit < 0 {
 		return nil, fmt.Errorf("limit must be non-negative")
 	}
+	if req.Limit > address.MaxEventQueryLimit {
+		return nil, fmt.Errorf("limit must be less than %d",
+			address.MaxEventQueryLimit)
+	}
 
 	sqlQuery.Offset = req.Offset
 	sqlQuery.Limit = req.Limit