From 024661123f20c469d7a90dde3a1db39882ec5b50 Mon Sep 17 00:00:00 2001 From: "daniel@poradnik-webmastera.com" Date: Sat, 6 Jul 2024 12:11:25 +0200 Subject: [PATCH] Fix ChannelOpen length validation Integer overflow in ChannelOpen length validation could cause crash. --- message_channel_open.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/message_channel_open.go b/message_channel_open.go index e7052f4..dac58ff 100644 --- a/message_channel_open.go +++ b/message_channel_open.go @@ -133,7 +133,7 @@ func (c *channelOpen) Unmarshal(raw []byte) error { labelLength := binary.BigEndian.Uint16(raw[8:]) protocolLength := binary.BigEndian.Uint16(raw[10:]) - if expectedLen := int(channelOpenHeaderLength + labelLength + protocolLength); len(raw) != expectedLen { + if expectedLen := channelOpenHeaderLength + int(labelLength) + int(protocolLength); len(raw) != expectedLen { return fmt.Errorf("%w expected(%d) actual(%d)", ErrExpectedAndActualLengthMismatch, expectedLen, len(raw)) }