From efec124c52dc79493fe1eb65186d0cf685ef1fae Mon Sep 17 00:00:00 2001 From: fufesou Date: Fri, 25 Sep 2026 00:35:47 +0800 Subject: [PATCH] Fix, online state, validate the data length (#16339) * fix(client): reject truncated online status responses Validate the bitmap length before indexing server-provided states. Return an error for short responses so they cannot panic or update cached online status. Signed-off-by: fufesou * docs(client): illustrate online status bitmap sizing Signed-off-by: fufesou --------- Signed-off-by: fufesou --- src/client.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/client.rs b/src/client.rs index ca4c87470..ef468b60c 100644 --- a/src/client.rs +++ b/src/client.rs @@ -5369,6 +5369,15 @@ pub mod peer_online { match msg_in.union { Some(rendezvous_message::Union::OnlineResponse(online_response)) => { let states = online_response.states; + // One bit per ID, rounded up to whole bytes: + // 0 IDs -> 0 bytes; 1..=8 -> 1; 9..=16 -> 2; 17..=24 -> 3. + let required_len = ids.len().div_ceil(u8::BITS as usize); + if states.len() < required_len { + bail!( + "Invalid online response: expected at least {required_len} state bytes, got {}", + states.len() + ); + } let mut onlines = Vec::new(); let mut offlines = Vec::new(); for i in 0..ids.len() {