Fix buffer overflow panics in frame metadata parsing

- Add bounds checking in buffered.go to prevent slice out-of-range panics
  when processing malformed RSocket frames with invalid metadata offsets
- Validate offset before accessing frame body to avoid panic on released frames
- Use overflow-safe arithmetic for metadata offset calculations
- Add comprehensive bounds checking in composite_metadata.go for malformed
  composite metadata to prevent panics during metadata parsing
- Replace magic number 3 with metadataLengthFieldSize constant for clarity

Fixes panic in trySliceData when offset exceeds body length, which occurred
during RSocket setup frame processing with malformed metadata length fields.

Author: podtserkovskiy

core/framing/buffered.go

@@ -12,6 +12,8 @@ import (
 	uberatomic "go.uber.org/atomic"
 )
 
+const metadataLengthFieldSize = 3 // Size of u24 metadata length field in bytes
+
 // bufferedFrame is basic frame implementation.
 type bufferedFrame struct {
 	innerPtr unsafe.Pointer
@@ -114,15 +116,22 @@ func (f *bufferedFrame) WriteTo(w io.Writer) (n int64, err error) {
 }
 
 func (f *bufferedFrame) trySeekMetadataLen(offset int) (n int, hasMetadata bool) {
+	// Validate offset before accessing frame to avoid panic on released frames
+	if offset < 0 {
+		return -1, false
+	}
 	raw := f.Body()
+	if raw == nil || offset >= len(raw) {
+		return -1, false
+	}
 	if offset > 0 {
 		raw = raw[offset:]
 	}
 	hasMetadata = f.HasFlag(core.FlagMetadata)
 	if !hasMetadata {
 		return
 	}
-	if len(raw) < 3 {
+	if len(raw) < metadataLengthFieldSize {
 		n = -1
 	} else {
 		n = u24.NewUint24Bytes(raw).AsInt()
@@ -135,18 +144,44 @@ func (f *bufferedFrame) trySliceMetadata(offset int) ([]byte, bool) {
 	if !ok || n < 0 {
 		return nil, false
 	}
-	return f.Body()[offset+3 : offset+3+n], true
+	body := f.Body()
+	if body == nil {
+		return nil, false
+	}
+	// Overflow-safe bounds check
+	metadataOffset := offset + metadataLengthFieldSize
+	if metadataOffset > len(body) {
+		return nil, false
+	}
+	if n > len(body)-metadataOffset {
+		return nil, false
+	}
+	return body[metadataOffset : metadataOffset+n], true
 }
 
 func (f *bufferedFrame) trySliceData(offset int) []byte {
+	body := f.Body()
+	if body == nil {
+		return nil
+	}
 	n, ok := f.trySeekMetadataLen(offset)
 	if !ok {
-		return f.Body()[offset:]
+		// trySeekMetadataLen already validated offset, safe to slice
+		return body[offset:]
 	}
 	if n < 0 {
 		return nil
 	}
-	return f.Body()[offset+n+3:]
+	// Overflow-safe bounds check
+	metadataOffset := offset + metadataLengthFieldSize
+	if metadataOffset > len(body) {
+		return nil
+	}
+	if n > len(body)-metadataOffset {
+		return nil
+	}
+	dataOffset := metadataOffset + n
+	return body[dataOffset:]
 }
 
 func (f *bufferedFrame) bodyLen() int {

extension/composite_metadata.go

@@ -2,6 +2,7 @@ package extension
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"github.com/rsocket/rsocket-go/internal/bytesconv"
 	"math"
@@ -57,7 +58,12 @@ func (c *CompositeMetadataScanner) Metadata() (mimeType string, metadata []byte,
 	return
 }
 
+const metadataLengthFieldSize = 3 // Size of u24 metadata length field in bytes
+
 func (c *CompositeMetadataScanner) decodeCompositeMetadataOnce(raw []byte) (length int, mimeType string, metadata []byte, err error) {
+	if len(raw) < 1 {
+		return 0, "", nil, errors.New("composite metadata: insufficient data for header")
+	}
 	m := raw[0]
 	size := 1
 	idOrLen := (m << 1) >> 1
@@ -66,11 +72,23 @@ func (c *CompositeMetadataScanner) decodeCompositeMetadataOnce(raw []byte) (leng
 	} else {
 		mimeTypeLen := int(idOrLen) + 1
 		size += mimeTypeLen
+		if size > len(raw) {
+			return 0, "", nil, errors.New("composite metadata: insufficient data for mime type")
+		}
 		mimeType = string(raw[1 : 1+mimeTypeLen])
 	}
-	metadataLen := u24.NewUint24Bytes(raw[size : size+3]).AsInt()
-	length = size + 3 + metadataLen
-	metadata = raw[size+3 : length]
+	if size+metadataLengthFieldSize > len(raw) {
+		return 0, "", nil, errors.New("composite metadata: insufficient data for metadata length")
+	}
+	metadataLen := u24.NewUint24Bytes(raw[size : size+metadataLengthFieldSize]).AsInt()
+	length = size + metadataLengthFieldSize + metadataLen
+	if length < 0 {
+		return 0, "", nil, errors.New("composite metadata: invalid negative length (integer overflow)")
+	}
+	if length > len(raw) {
+		return 0, "", nil, errors.New("composite metadata: metadata length exceeds available data")
+	}
+	metadata = raw[size+metadataLengthFieldSize : length]
 	return
 }