From 8b8156dbf7a9cf688e6d0ccd8ab9d428ec3a400b Mon Sep 17 00:00:00 2001
From: levlam <levlam@telegram.org>
Date: Sat, 4 Jul 2026 00:07:41 +0300
Subject: Check maximum number of inline query results.

---
 td/telegram/InlineQueriesManager.cpp | 6 +++++-
 td/telegram/InlineQueriesManager.h   | 5 +++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/td/telegram/InlineQueriesManager.cpp b/td/telegram/InlineQueriesManager.cpp
index fc8aeb6e6..78662e2f7 100644
--- a/td/telegram/InlineQueriesManager.cpp
+++ b/td/telegram/InlineQueriesManager.cpp
@@ -739,7 +739,11 @@ void InlineQueriesManager::answer_inline_query(
     }
   }
 
-  vector<tl_object_ptr<telegram_api::InputBotInlineResult>> results;
+  if (input_results.size() > MAX_INLINE_QUERY_RESULT_COUNT) {
+    return promise.set_error(400, "Too many inline query results specified");
+  }
+
+  vector<telegram_api::object_ptr<telegram_api::InputBotInlineResult>> results;
   bool is_gallery = false;
   bool force_vertical = false;
   for (auto &input_result : input_results) {
diff --git a/td/telegram/InlineQueriesManager.h b/td/telegram/InlineQueriesManager.h
index c11c8480c..f8ca5155c 100644
--- a/td/telegram/InlineQueriesManager.h
+++ b/td/telegram/InlineQueriesManager.h
@@ -109,8 +109,9 @@ class InlineQueriesManager final : public Actor {
       tl_object_ptr<telegram_api::InputBotInlineMessageID> &&input_bot_inline_message_id);
 
  private:
-  static constexpr size_t MAX_RECENT_INLINE_BOTS = 20;  // some reasonable value
-  static constexpr int32 INLINE_QUERY_DELAY_MS = 400;   // server-side limit
+  static constexpr size_t MAX_RECENT_INLINE_BOTS = 20;              // some reasonable value
+  static constexpr int32 INLINE_QUERY_DELAY_MS = 400;               // server-side limit
+  static constexpr std::size_t MAX_INLINE_QUERY_RESULT_COUNT = 50;  // server-side limit
 
   Result<tl_object_ptr<telegram_api::InputBotInlineResult>> get_input_bot_inline_result(
       td_api::object_ptr<td_api::InputInlineQueryResult> &&result, bool *is_gallery, bool *force_vertical) const;
-- 
cgit v1.2.3