From 46aa8efb354c2e4190b50ccc4d8e329212c65f7b Mon Sep 17 00:00:00 2001
From: Andrew Steinborn <git@steinborn.me>
Date: Sun, 9 Sep 2018 14:37:43 -0400
Subject: [PATCH] Improve reliability of varint decoder.

---
 .../netty/MinecraftVarintFrameDecoder.java    | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftVarintFrameDecoder.java b/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftVarintFrameDecoder.java
index 081253594..ec2f9ded7 100644
--- a/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftVarintFrameDecoder.java
+++ b/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftVarintFrameDecoder.java
@@ -2,8 +2,10 @@ package com.velocitypowered.proxy.protocol.netty;
 
 import com.velocitypowered.proxy.protocol.ProtocolUtils;
 import io.netty.buffer.ByteBuf;
+import io.netty.buffer.Unpooled;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.ByteToMessageDecoder;
+import io.netty.handler.codec.CorruptedFrameException;
 
 import java.util.List;
 
@@ -15,12 +17,26 @@ public class MinecraftVarintFrameDecoder extends ByteToMessageDecoder {
         }
 
         in.markReaderIndex();
-        int packetLength = ProtocolUtils.readVarInt(in);
-        if (in.readableBytes() < packetLength) {
-            in.resetReaderIndex();
-            return;
+
+        byte[] lenBuf = new byte[3];
+        for (int i = 0; i < lenBuf.length; i++) {
+            lenBuf[i] = in.readByte();
+            if (lenBuf[i] > 0) {
+                int packetLength = ProtocolUtils.readVarInt(Unpooled.wrappedBuffer(lenBuf));
+                if (packetLength == 0) {
+                    return;
+                }
+
+                if (in.readableBytes() < packetLength) {
+                    in.resetReaderIndex();
+                    return;
+                }
+
+                out.add(in.readRetainedSlice(packetLength));
+                return;
+            }
         }
 
-        out.add(in.readRetainedSlice(packetLength));
+        throw new CorruptedFrameException("VarInt too big");
     }
 }