Fix ChannelOpen length validation

Integer overflow in ChannelOpen length validation could cause crash.
pion · Jul 6, 2024 · 0246611 · 0246611
1 parent 498e053
commit 0246611
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/message_channel_open.go b/message_channel_open.go
@@ -133,7 +133,7 @@ func (c *channelOpen) Unmarshal(raw []byte) error {
 	labelLength := binary.BigEndian.Uint16(raw[8:])
 	protocolLength := binary.BigEndian.Uint16(raw[10:])
 
-	if expectedLen := int(channelOpenHeaderLength + labelLength + protocolLength); len(raw) != expectedLen {
+	if expectedLen := channelOpenHeaderLength + int(labelLength) + int(protocolLength); len(raw) != expectedLen {
 		return fmt.Errorf("%w expected(%d) actual(%d)", ErrExpectedAndActualLengthMismatch, expectedLen, len(raw))
 	}