From 2d2348f6714768f960a10f956bd27467940b2270 Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Sun, 3 Aug 2014 14:36:20 +0000
Subject: [PATCH] payload bounds check

---
 core/java/src/net/i2p/data/Payload.java           | 15 +++++++++++++--
 router/java/src/net/i2p/router/RouterVersion.java |  2 +-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/core/java/src/net/i2p/data/Payload.java b/core/java/src/net/i2p/data/Payload.java
index 825b632fe..3f1cfbc66 100644
--- a/core/java/src/net/i2p/data/Payload.java
+++ b/core/java/src/net/i2p/data/Payload.java
@@ -29,6 +29,9 @@ public class Payload extends DataStructureImpl {
     private byte[] _encryptedData;
     private byte[] _unencryptedData;
 
+    /** So we don't OOM on I2CP protocol errors. Actual max is smaller. */
+    private static final int MAX_LENGTH = 64*1024;
+
     public Payload() {
     }
 
@@ -51,8 +54,11 @@ public class Payload extends DataStructureImpl {
      * 
      * Deprecated.
      * Unless you are doing encryption, use setEncryptedData() instead.
+     * @throws IllegalArgumentException if bigger than 64KB
      */
     public void setUnencryptedData(byte[] data) {
+        if (data.length > MAX_LENGTH)
+            throw new IllegalArgumentException();
         _unencryptedData = data;
     }
 
@@ -61,8 +67,13 @@ public class Payload extends DataStructureImpl {
         return _encryptedData;
     }
 
-    /** the real data */
+    /**
+     * the real data
+     * @throws IllegalArgumentException if bigger than 64KB
+     */
     public void setEncryptedData(byte[] data) {
+        if (data.length > MAX_LENGTH)
+            throw new IllegalArgumentException();
         _encryptedData = data;
     }
 
@@ -77,7 +88,7 @@ public class Payload extends DataStructureImpl {
     
     public void readBytes(InputStream in) throws DataFormatException, IOException {
         int size = (int) DataHelper.readLong(in, 4);
-        if (size < 0) throw new DataFormatException("payload size out of range (" + size + ")");
+        if (size < 0 || size > MAX_LENGTH) throw new DataFormatException("payload size out of range (" + size + ")");
         _encryptedData = new byte[size];
         int read = read(in, _encryptedData);
         if (read != size) throw new DataFormatException("Incorrect number of bytes read in the payload structure");
diff --git a/router/java/src/net/i2p/router/RouterVersion.java b/router/java/src/net/i2p/router/RouterVersion.java
index 416f03574..8c2560977 100644
--- a/router/java/src/net/i2p/router/RouterVersion.java
+++ b/router/java/src/net/i2p/router/RouterVersion.java
@@ -18,7 +18,7 @@ public class RouterVersion {
     /** deprecated */
     public final static String ID = "Monotone";
     public final static String VERSION = CoreVersion.VERSION;
-    public final static long BUILD = 2;
+    public final static long BUILD = 3;
 
     /** for example "-test" */
     public final static String EXTRA = "-rc";