message: fix go-fuzz crashers (#8)

mdlayher · Dec 23, 2016 · 2861fca · 2861fca
1 parent 1149baf
commit 2861fca
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/message.go b/message.go
@@ -120,7 +120,12 @@ func (m *Message) UnmarshalBinary(b []byte) error {
 		return errUnalignedMessage
 	}
 
+	// Don't allow misleading length
 	m.Header.Length = Uint32(b[0:4])
+	if int(m.Header.Length) != len(b) {
+		return errShortMessage
+	}
+
 	m.Header.Type = HeaderType(Uint16(b[4:6]))
 	m.Header.Flags = HeaderFlags(Uint16(b[6:8]))
 	m.Header.Sequence = Uint32(b[8:12])

diff --git a/message_test.go b/message_test.go
@@ -134,6 +134,16 @@ func TestMessageUnmarshal(t *testing.T) {
 			b:    make([]byte, 17),
 			err:  errUnalignedMessage,
 		},
+		{
+			name: "fuzz crasher: length shorter than slice",
+			b:    []byte("\x1d000000000000000"),
+			err:  errShortMessage,
+		},
+		{
+			name: "fuzz crasher: length longer than slice",
+			b:    []byte("\x13\x00\x00\x000000000000000000"),
+			err:  errShortMessage,
+		},
 		{
 			name: "OK no data",
 			b: []byte{