storm/barnard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reject an out-of-range tunnelled audio length

Browse Source 
The length is taken from the packet and only checked against the upper
bound, so a negative value passed the check and then panicked on the slice
expression that follows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon McGinty
2026-08-24 12:30:56 -04:00
co-authored by Claude Opus 5
parent 1e73d192ba
commit f03d576604
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gumble/gumble/handlers.go
+4 -2
View File
@@ -184,8 +184,10 @@ func (c *Client) handleUDPTunnel(buffer []byte) error {
log.Info("handleUDPTunnel: %s session=%d seq=%d audio_len=%d final=%v buf_remain=%d", log.Info("handleUDPTunnel: %s session=%d seq=%d audio_len=%d final=%v buf_remain=%d",
user.Name, session, seq, audioLength, isFinal, len(buffer)) user.Name, session, seq, audioLength, isFinal, len(buffer))
if audioLength > len(buffer) { // A negative length would pass the upper bound check below and then panic
log.Warn("handleUDPTunnel: audio length %d > remaining buffer %d", // on the slice expression.
if audioLength < 0 || audioLength > len(buffer) {
log.Warn("handleUDPTunnel: audio length %d out of range for buffer %d",
audioLength, len(buffer)) audioLength, len(buffer))
return errInvalidProtobuf return errInvalidProtobuf
} }