proxy/src/main/java/com/velocitypowered/proxy/protocol/ProtocolUtils.java

@@ -156,6 +156,29 @@ public enum ProtocolUtils {
     return Integer.MIN_VALUE;
   }
 
+  /**
+   * Reads a Minecraft-style VarInt from the specified {@code buf}. The difference between this
+   * method and {@link #readVarInt(ByteBuf)} is that this function returns a sentinel value if the
+   * varint is invalid.
+   *
+   * @param buf the buffer to read from
+   * @return the decoded VarInt
+   * @throws DecoderException if the varint is invalid
+   */
+  public static int readVarIntSafelyOrThrow(ByteBuf buf) {
+    int i = 0;
+    int maxRead = Math.min(5, buf.readableBytes());
+    for (int j = 0; j < maxRead; j++) {
+      int k = buf.readByte();
+      i |= (k & 0x7F) << j * 7;
+      if ((k & 0x80) != 128) {
+        return i;
+      }
+    }
+    throw MinecraftDecoder.DEBUG ? new CorruptedFrameException("Bad VarInt decoded")
+        : BAD_VARINT_CACHED;
+  }
+
   /**
    * Returns the exact byte size of {@code value} if it were encoded as a VarInt.
    *

proxy/src/main/java/com/velocitypowered/proxy/protocol/packet/LoginPluginMessagePacket.java

@@ -63,7 +63,7 @@ public class LoginPluginMessagePacket extends DeferredByteBufHolder implements M
 
   @Override
   public void decode(ByteBuf buf, ProtocolUtils.Direction direction, ProtocolVersion version) {
-    this.id = ProtocolUtils.readVarInt(buf);
+    this.id = ProtocolUtils.readVarIntSafelyOrThrow(buf);
     this.channel = ProtocolUtils.readString(buf);
     if (buf.isReadable()) {
       this.replace(buf.readRetainedSlice(buf.readableBytes()));