From 69368792a2bd411d0d4697f53f4cb657f8c030b3 Mon Sep 17 00:00:00 2001
From: Michael Klishin <michaelklishin@icloud.com>
Date: Mon, 13 Apr 2026 08:30:32 -0700
Subject: [PATCH] Report a malformed frame in one more case

---
 src/main/java/com/rabbitmq/client/impl/Frame.java           | 6 +++---
 .../com/rabbitmq/client/impl/NettyFrameHandlerFactory.java  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/main/java/com/rabbitmq/client/impl/Frame.java b/src/main/java/com/rabbitmq/client/impl/Frame.java
index bf83c1cf5f..f38e98db9e 100644
--- a/src/main/java/com/rabbitmq/client/impl/Frame.java
+++ b/src/main/java/com/rabbitmq/client/impl/Frame.java
@@ -108,9 +108,9 @@ public static Frame readFrom(DataInputStream is, int maxPayloadSize) throws IOEx
 
         channel = is.readUnsignedShort();
         int payloadSize = is.readInt();
-        if (payloadSize >= maxPayloadSize) {
-            throw new IllegalStateException(format(
-                "Frame body is too large (%d), maximum configured size is %d. " +
+        if (payloadSize < 0 || payloadSize >= maxPayloadSize) {
+            throw new MalformedFrameException(format(
+                "Frame body size is invalid (%d), maximum configured size is %d. " +
                     "See ConnectionFactory#setMaxInboundMessageBodySize " +
                     "if you need to increase the limit.",
                 payloadSize, maxPayloadSize
diff --git a/src/main/java/com/rabbitmq/client/impl/NettyFrameHandlerFactory.java b/src/main/java/com/rabbitmq/client/impl/NettyFrameHandlerFactory.java
index abac9151a8..483265f3aa 100644
--- a/src/main/java/com/rabbitmq/client/impl/NettyFrameHandlerFactory.java
+++ b/src/main/java/com/rabbitmq/client/impl/NettyFrameHandlerFactory.java
@@ -469,10 +469,10 @@ public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception
         int type = m.readUnsignedByte();
         int channel = m.readUnsignedShort();
         int payloadSize = m.readInt();
-        if (payloadSize >= maxPayloadSize) {
-          throw new IllegalStateException(
+        if (payloadSize < 0 || payloadSize >= maxPayloadSize) {
+          throw new MalformedFrameException(
               format(
-                  "Frame body is too large (%d), maximum configured size is %d. "
+                  "Frame body size is invalid (%d), maximum configured size is %d. "
                       + "See ConnectionFactory#setMaxInboundMessageBodySize "
                       + "if you need to increase the limit.",
                   payloadSize, maxPayloadSize));