diff --git a/message.go b/message.go index f88608f..ed3126c 100644 --- a/message.go +++ b/message.go @@ -120,7 +120,12 @@ func (m *Message) UnmarshalBinary(b []byte) error { return errUnalignedMessage } + // Don't allow misleading length m.Header.Length = Uint32(b[0:4]) + if int(m.Header.Length) != len(b) { + return errShortMessage + } + m.Header.Type = HeaderType(Uint16(b[4:6])) m.Header.Flags = HeaderFlags(Uint16(b[6:8])) m.Header.Sequence = Uint32(b[8:12]) diff --git a/message_test.go b/message_test.go index 9a3eeeb..d7d6757 100644 --- a/message_test.go +++ b/message_test.go @@ -134,6 +134,16 @@ func TestMessageUnmarshal(t *testing.T) { b: make([]byte, 17), err: errUnalignedMessage, }, + { + name: "fuzz crasher: length shorter than slice", + b: []byte("\x1d000000000000000"), + err: errShortMessage, + }, + { + name: "fuzz crasher: length longer than slice", + b: []byte("\x13\x00\x00\x000000000000000000"), + err: errShortMessage, + }, { name: "OK no data", b: []byte{