From a7b8bfb3ae6bf5e2dbee57c7e3b6658853ba2ca8 Mon Sep 17 00:00:00 2001 From: Aaron Kimbrell Date: Tue, 10 Nov 2026 16:06:49 -0600 Subject: [PATCH] fix: adapt the length prefixed reader to check a length against the data left The reader the message structs share made room for the length it read, up to the message limit, before it found that the stream held less. The length now has to fit in the data the stream has left first. Co-Authored-By: Claude Fable 5.2 --- dNet/BitStreamUtils.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dNet/BitStreamUtils.h b/dNet/BitStreamUtils.h index 620b200e9..5f6eba968 100644 --- a/dNet/BitStreamUtils.h +++ b/dNet/BitStreamUtils.h @@ -138,6 +138,8 @@ namespace BitStreamUtils { if (length < 0) return false; } if (static_cast(length) > maxLength) return false; + // The stream can not hold more characters than it has bytes left + if (static_cast(length) * sizeof(typename StringT::value_type) * 8 > static_cast(bitStream.GetNumberOfUnreadBits())) return false; value.resize(length); if (length == 0) return true; return bitStream.ReadBits(reinterpret_cast(value.data()), BYTES_TO_BITS(value.size() * sizeof(typename StringT::value_type)), true);