[Bug] A malformed packet can be used to leak old packets

[pixelomer]

• MessageReader.GetSized() will return a reader without cleaning the buffer if there is a reader in the reader pool with a buffer that is big enough.
• MessageReader.ReadString() doesn't do any bound checks. You can supply it any packed integer and it will happily try to read up to 0x7FFFFFFF bytes from the reader buffer. Any value higher than 0xFFFF will cause an exception to be thrown on servers that do not manually specify a buffer size. This issue can also be used to leak old packets. If the server echoes what it reads from the packet back to the client, and if the reader was recycled using MessageReader.GetSized(), the server will send the data of an old packet (probably from a different client) to the client.

Example client code that exploits this and example vulnerable server

[willardf]

Thanks for bringing this up, do you have any interest in reviewing this or testing it with your example or should I just merge it?

[pixelomer]

I just tested the changes using my example project and that project doesn't work anymore which is a good thing. I think it can be merged.

[willardf]

Great, thanks!