FIX(server): Don't allow poslen > len

This case can crash the server as the calculated buffer length without
positional data (which is the normal case) is negative (len - poslen).

1 files changed, 8 insertions, 0 deletions

diff --git a/src/murmur/Server.cpp b/src/murmur/Server.cpp
index 530e02354..4d97c92cf 100644
--- a/src/murmur/Server.cpp
+++ b/src/murmur/Server.cpp
@@ -1110,6 +1110,14 @@ void Server::processMsg(ServerUser *u, const char *data, int len) {
 
 	len = pds.size() + 1;
 
+	if (poslen > static_cast<unsigned int>(len)) {
+		// poslen must never ever be bigger than len as this could lead to negative buffer sizes (len - poslen) being
+		// used when further processing the packet.
+		// Usually this shouldn't happen in the first place but can happen with malformed/malicious packets in certain
+		// cases.
+		poslen = 0;
+	}
+
 	/// A set of users that'll receive the audio buffer because they are listening
 	/// to a channel that received that audio.
 	QSet<ServerUser *> listeningUsers;