Prevent array from crossing boundaries

topfreegames · Sep 13, 2023 · 9332cee · 9332cee
1 parent d216cf2
commit 9332cee
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/conn/message/message_encoder.go b/conn/message/message_encoder.go
@@ -161,8 +161,13 @@ func Decode(data []byte) (*Message, error) {
 
 	m.Err = flag&errorMask == errorMask
 
+	size := len(data)
 	if routable(m.Type) {
 		if flag&msgRouteCompressMask == 1 {
+			if offset > size || (offset+2) > size {
+				return nil, ErrInvalidMessage
+			}
+
 			m.compressed = true
 			code := binary.BigEndian.Uint16(data[offset:(offset + 2)])
 			routesCodesMutex.RLock()
@@ -177,11 +182,19 @@ func Decode(data []byte) (*Message, error) {
 			m.compressed = false
 			rl := data[offset]
 			offset++
+
+			if offset > size || (offset+int(rl)) > size {
+				return nil, ErrInvalidMessage
+			}
 			m.Route = string(data[offset:(offset + int(rl))])
 			offset += int(rl)
 		}
 	}
 
+	if offset > size {
+		return nil, ErrInvalidMessage
+	}
+
 	m.Data = data[offset:]
 	var err error
 	if flag&gzipMask == gzipMask {