CalDAV: Enforce cumulative iCalendar instances cap in CalDAV free-busy REPORT handler

CHANGELOG.md

@@ -93,6 +93,7 @@ This version includes **multiple breaking changes**. If you are upgrading from v
   - Use RFC 2616 instead of RFC 1123 for date formatting
   - Fix ACL container/item mismatch in reports.
   - CalDAV: Allow organized properties to be present in `PUT` requests if they are equal to the existing ones.
+  - CalDAV: Enforce cumulative iCalendar instances cap in CalDAV free-busy REPORT handler
 - Configuration: Prefix parsing issues (#2495)
 - OIDC: JWKS Exposes Symmetric Signing Key
 - SQLite: Fix thread pool exhaustion.

crates/dav/src/calendar/freebusy.rs

@@ -160,6 +160,8 @@ impl CalendarFreebusyRequestHandler for Server {
 
             let mut fb_entries: AHashMap<ICalendarFreeBusyType, Vec<(i64, i64)>> =
                 AHashMap::with_capacity(document_ids.len());
+            let max_instances = self.core.groupware.max_ical_instances;
+            let mut total_instances: usize = 0;
 
             for document_id in document_ids {
                 let Some(archive) = self
@@ -212,6 +214,11 @@ impl CalendarFreebusyRequestHandler for Server {
                     continue;
                 }
 
+                total_instances = total_instances.saturating_add(events.len());
+                if total_instances > max_instances {
+                    return Err(DavError::Code(StatusCode::PAYLOAD_TOO_LARGE));
+                }
+
                 for (component_id, component) in components {
                     let component_id = component_id as u32;
                     match component.component_type {