dragonflyoss / dragonflyoss/vortex-protocol
bug: Vortex::try_from accepts malformed Close packets with payloads
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 14
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Bug report:
Vortex::try_from(Bytes) accepts Close packets with a non-empty value, even though Close is documented and serialized as a zero-length packet.
Expected behavior:
It should reject malformed Close packets with InvalidLength.
How to reproduce it:
use bytes::{BufMut, Bytes, BytesMut};
use vortex_protocol::{Header, Vortex};
use vortex_protocol::tlv::Tag;
let header = Header::new(Tag::Close, 4);
let header_bytes: Bytes = header.into();
let value = Bytes::from_static(b"test");
let mut packet_bytes = BytesMut::new();
packet_bytes.extend_from_slice(&header_bytes);
packet_bytes.extend_from_slice(&value);
let packet = Vortex::try_from(packet_bytes.freeze());
assert!(packet.is_err());
Current behavior on main: this parses as Vortex::Close(_). If it is serialized again, the payload is dropped.
This is triggerable in practice. The malformed packet is only 10 bytes total, so no cloud quota, API limit, MTU, or resource ceiling gets in the way. Any buggy or malicious peer can send it.
Environment:
- Vortex version:
main/0.1.5 - OS: Linux
- Others: tiny payload, no special setup needed
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at Vortex::try_from(Bytes) and follow how Header, Tag::Close, and packet payload lengths are validated. Reproduce the malformed Close packet from the issue, then verify that it returns InvalidLength and that valid zero-length Close packets still parse and serialize correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100