Skip to content

Fix buffer overflow panics in frame metadata parsing#150

Merged
jjeffcaii merged 1 commit into
rsocket:masterfrom
podtserkovskiy:fix/buffered-frame-bounds-check
Jun 15, 2026
Merged

Fix buffer overflow panics in frame metadata parsing#150
jjeffcaii merged 1 commit into
rsocket:masterfrom
podtserkovskiy:fix/buffered-frame-bounds-check

Conversation

@podtserkovskiy

@podtserkovskiy podtserkovskiy commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Add bounds checks in trySeekMetadataLen, trySliceMetadata, and trySliceData
so malformed frames with a bogus metadata length return nil instead of
panicking on the slice expression.

@podtserkovskiy

Copy link
Copy Markdown
Contributor Author

level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 2: stderr: flag provided but not defined: -buildvcs\nusage: go list [-f format] [-json] [-m] [list flags] [build flags] [packages]\nRun 'go help list' for details.\n"

Lint error looks unrelated to the change

@podtserkovskiy podtserkovskiy force-pushed the fix/buffered-frame-bounds-check branch from 58cb282 to 9503cd1 Compare June 10, 2026 22:43
Add bounds checks in trySeekMetadataLen, trySliceMetadata, and trySliceData
so malformed frames with a bogus metadata length return nil instead of
panicking on the slice expression.
@podtserkovskiy podtserkovskiy force-pushed the fix/buffered-frame-bounds-check branch from 9503cd1 to 6e0c262 Compare June 11, 2026 11:40

@jjeffcaii jjeffcaii left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jjeffcaii jjeffcaii merged commit 5b4772b into rsocket:master Jun 15, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants