pmmp / binaryutils Goto Github PK

$buf = new \pocketmine\utils\BinaryStream("\x80\x80\x80\x80\x80\x01");
var_dump($buf->getUnsignedVarInt());

This code should throw an exception because there is a 6-byte varint in the buffer, but it does not.

Currently trying to read past the end of available data will cause lots of strange behaviour to occur. This should be explicitly checked instead of returning partial data or returning the wrong type of data (bool instead of string).

A lot of types are missing signed vs unsigned readers, and it isn't clear whether the existing methods return signed or unsigned values in a lot of cases. This is a problem because wrong values may be retrieved when reading userdata.

This bug was discovered during a bruteforce debugging test of packets.

When Binary::readUnsignedVarInt() or Binary::readUnsignedVarLong() receives a buffer with an offset which points at somewhere outside of the buffer, an E_NOTICE is triggered due to Uninitialized string offset. This read results in an empty string, which ord() happily swallows and yields 0 from.

This should instead be throwing an OutOfBoundsException when such behaviour occurs.

The current code accepts any non-zero value for true and 0 for false, but if a value outside of the range 0-1 is encountered, it most likely indicates corrupted data or broken code.