Stricter header validation

[netstring.git] / r.go

diff --git a/r.go b/r.go
index 0637ec692af823aeaba9abf7ffe462a041b00677..9b8f51069e541d86986497e383dec57349f563b8 100644 (file)
--- a/r.go
+++ b/r.go
@@ -1,6 +1,6 @@
 /*
 netstring -- netstring format serialization library
-Copyright (C) 2015-2021 Sergey Matveev <stargrave@stargrave.org>
+Copyright (C) 2015-2023 Sergey Matveev <stargrave@stargrave.org>
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -19,8 +19,8 @@ package netstring
 
 import (
        "bufio"
-       "bytes"
        "errors"
+       "fmt"
        "io"
        "strconv"
 )
@@ -44,20 +44,17 @@ func (r *Reader) Next() (uint64, error) {
        if !r.eof {
                return 0, errors.New("current chunk is unread")
        }
-       p, _ := r.r.Peek(21)
-       if len(p) == 0 {
-               return 0, io.EOF
+       lenRaw, err := r.r.ReadSlice(':')
+       if err != nil {
+               return 0, fmt.Errorf("netstring header: %w", err)
        }
-       idx := bytes.IndexByte(p, ':')
-       if idx == -1 {
-               return 0, errors.New("no length separator found")
+       lenRaw = lenRaw[:len(lenRaw)-1]
+       if len(lenRaw) > 1 && lenRaw[0] == '0' {
+               return 0, errors.New("netstring header: leading zero")
        }
-       size, err := strconv.ParseUint(string(p[:idx]), 10, 64)
+       size, err := strconv.ParseUint(string(lenRaw), 10, 64)
        if err != nil {
-               return 0, err
-       }
-       if _, err = r.r.Discard(idx + 1); err != nil {
-               return 0, err
+               return 0, fmt.Errorf("netstring header: %w", err)
        }
        r.left = size
        r.eof = false
@@ -67,10 +64,10 @@ func (r *Reader) Next() (uint64, error) {
 func (r *Reader) checkTerminator() error {
        b, err := r.r.ReadByte()
        if err != nil {
-               return err
+               return fmt.Errorf("netstring terminator: %w", err)
        }
        if b != ',' {
-               return errors.New("no terminator found")
+               return errors.New("netstring terminator: not found")
        }
        return nil
 }