From d3c5c858620aaeb2d94ce29c15fa87cb39156e51 Mon Sep 17 00:00:00 2001 From: linsaftw <25271111+linsaftw@users.noreply.github.com> Date: Wed, 19 May 2021 15:40:41 -0300 Subject: [PATCH] Limit String read diff --git a/protocol/src/main/java/net/md_5/bungee/protocol/DefinedPacket.java b/protocol/src/main/java/net/md_5/bungee/protocol/DefinedPacket.java index 93d17f6b..dfcba274 100644 --- a/protocol/src/main/java/net/md_5/bungee/protocol/DefinedPacket.java +++ b/protocol/src/main/java/net/md_5/bungee/protocol/DefinedPacket.java @@ -36,12 +36,13 @@ public abstract class DefinedPacket public static String readString(ByteBuf buf) { - return readString( buf, Short.MAX_VALUE ); + return readString( buf, 1024 ); // FlameCord } public static String readString(ByteBuf buf, int maxLen) { int len = readVarInt( buf ); + if ( len > maxLen * 4 ) { if(!MinecraftDecoder.DEBUG) throw STRING_TOO_MANY_BYTES_EXCEPTION; // Waterfall start: Additional DoS mitigations -- 2.31.1