Go through all messages, go to inputstream based constructor and add input validation on fields which lead to variable length read in.

Make them take ByteBuffer as input again, instead of the stupid stream (dough).

Instead use stream to first load buffer according to length field in payload, and then send this bytebuffer into constructors.

This makes constructors independent of source, could be binary dumps or whatever. Also removes IOException from everywhere, which is nice, and the need to import the damn Guava Little endian stream reader from everywhere.

Live and learn...

Put all exceptions in packages where they are generated. E.g. there are tons of exceptions for building messages, they should be in a subpackage of message package.

Also perhaps come up with better names for some of them, many seem awfully similar. Perhaps some how encode what class generates them.