Additional protection for bad state when rebuilding a message block

Signed-off-by: Derek Collison <derek@nats.io>
nats-io · Mar 29, 2023 · ddfa5cd · ddfa5cd
1 parent a9a4df8
commit ddfa5cd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/server/filestore.go b/server/filestore.go
@@ -1044,7 +1044,7 @@ func (mb *msgBlock) rebuildStateLocked() (*LostStreamData, error) {
 		rl &^= hbit
 		dlen := int(rl) - msgHdrSize
 		// Do some quick sanity checks here.
-		if dlen < 0 || int(slen) > dlen || dlen > int(rl) || rl > rlBadThresh {
+		if dlen < 0 || int(slen) > (dlen-8) || dlen > int(rl) || rl > rlBadThresh {
 			truncate(index)
 			return gatherLost(lbuf - index), errBadMsg
 		}