Skip to content

Fix TCP message handling panics and oversized allocations - #3889

Open
Aditya30ag wants to merge 3 commits into
AFLplusplus:mainfrom
Aditya30ag:fix/tcp-message-validation
Open

Fix TCP message handling panics and oversized allocations#3889
Aditya30ag wants to merge 3 commits into
AFLplusplus:mainfrom
Aditya30ag:fix/tcp-message-validation

Conversation

@Aditya30ag

Copy link
Copy Markdown
Contributor

Summary

This PR improves robustness of TCP message handling by preventing panics and unsafe allocations when receiving malformed input.

Changes

  • Replace TCP receive expect()/panic paths with proper error propagation.
  • Add maximum message size checks before allocating buffers.
  • Reject oversized length prefixes from untrusted peers.
  • Add regression tests for:
    • Truncated TCP messages causing incomplete reads.
    • Oversized message length prefixes.

Previously, malformed TCP input could:

  • Trigger a panic when the peer disconnected before sending the full message.
  • Cause excessive memory allocation attempts by sending a very large length prefix.

These changes ensure invalid input results in an error instead of crashing the process.

Testing

Tested with:

cargo test -p ll_mp test_recv_tcp_msg
cargo clippy -p ll_mp --tests

#3888 

@Aditya30ag
Aditya30ag marked this pull request as draft August 12, 2026 09:36
@Aditya30ag
Aditya30ag marked this pull request as ready for review August 12, 2026 09:50
len += 4;
log::debug!("TCP Manager - len = {len:?}");

if len > TCP_MAX_MSG_LEN {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if you want this to be 100% correct you also should check for size before adding 4 to the len (since at this point it could already have overflown for MAX_INT)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. I changed the length calculation to use checked_add(4) before applying the maximum message size check, so the addition is now protected against integer overflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants