From f03d5766040b59ee5f7389ee2e1d9d23dc655d34 Mon Sep 17 00:00:00 2001 From: Brandon McGinty Date: Mon, 24 Aug 2026 12:30:56 -0400 Subject: [PATCH] reject an out-of-range tunnelled audio length The length is taken from the packet and only checked against the upper bound, so a negative value passed the check and then panicked on the slice expression that follows. Co-Authored-By: Claude Opus 5 --- gumble/gumble/handlers.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/gumble/gumble/handlers.go b/gumble/gumble/handlers.go index b893dd7..9d47dde 100644 --- a/gumble/gumble/handlers.go +++ b/gumble/gumble/handlers.go @@ -184,8 +184,10 @@ func (c *Client) handleUDPTunnel(buffer []byte) error { log.Info("handleUDPTunnel: %s session=%d seq=%d audio_len=%d final=%v buf_remain=%d", user.Name, session, seq, audioLength, isFinal, len(buffer)) - if audioLength > len(buffer) { - log.Warn("handleUDPTunnel: audio length %d > remaining buffer %d", + // A negative length would pass the upper bound check below and then panic + // on the slice expression. + if audioLength < 0 || audioLength > len(buffer) { + log.Warn("handleUDPTunnel: audio length %d out of range for buffer %d", audioLength, len(buffer)) return errInvalidProtobuf }