From 8abe6bb389621b87616cb6c42bcde3b9e79ceff3 Mon Sep 17 00:00:00 2001 From: Sai Asish Y Date: Thu, 18 Jun 2026 12:09:07 -0700 Subject: [PATCH] fix(teleport): reject negative message length in Unpack to avoid panic Signed-off-by: Sai Asish Y --- app/distribute/teleport/protocol.go | 2 +- app/distribute/teleport/protocol_test.go | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/app/distribute/teleport/protocol.go b/app/distribute/teleport/protocol.go index 336914c1..b6467508 100644 --- a/app/distribute/teleport/protocol.go +++ b/app/distribute/teleport/protocol.go @@ -44,7 +44,7 @@ func (p *Protocol) Unpack(buffer []byte) (readerSlice [][]byte, bufferOver []byt } if string(buffer[i:i+p.headerLen]) == p.header { messageLength := BytesToInt(buffer[i+p.headerLen : i+p.headerLen+DataLengthOfLenth]) - if length < i+p.headerLen+DataLengthOfLenth+messageLength { + if messageLength < 0 || length < i+p.headerLen+DataLengthOfLenth+messageLength { break } data := buffer[i+p.headerLen+DataLengthOfLenth : i+p.headerLen+DataLengthOfLenth+messageLength] diff --git a/app/distribute/teleport/protocol_test.go b/app/distribute/teleport/protocol_test.go index 3f4d8f7a..b15d3c4b 100644 --- a/app/distribute/teleport/protocol_test.go +++ b/app/distribute/teleport/protocol_test.go @@ -140,6 +140,19 @@ func TestProtocol_Unpack_TooShort(t *testing.T) { } } +func TestProtocol_Unpack_NegativeLength(t *testing.T) { + p := NewProtocol("ab") + buf := append([]byte("ab"), IntToBytes(-1)...) + buf = append(buf, []byte("xx")...) + slice, rest := p.Unpack(buf) + if len(slice) != 0 { + t.Errorf("len(slice) = %d, want 0", len(slice)) + } + if !bytes.Equal(rest, buf) { + t.Errorf("rest = %v, want %v", rest, buf) + } +} + func TestIntToBytes_BytesToInt(t *testing.T) { tests := []int{0, 1, 42, 1024, -1} for _, n := range tests {