From 4f119644fec6b556f68c924ad541a53454ddb91e Mon Sep 17 00:00:00 2001
From: parthod0x <parthms.id@gmail.com>
Date: Thu, 15 Oct 2026 23:42:38 +0530
Subject: [PATCH] connection: reject oversized payload without overrunning the
 receive buffer

receivePacketWithHeaderAs zeroed `remainingSize` bytes of mBuffer, but
remainingSize is derived from the node-controlled header size() (which
returns INT32_MAX when the size field is zero), so it can exceed mBuffer
and std::fill_n would write past it.

Fill only sizeof(T) -- the bytes actually read back into result -- and let
receiveData()'s existing `sz > buffer.size()` guard reject an oversized
payload.
---
 connection.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/connection.cpp b/connection.cpp
index fa688b9..cc209af 100644
--- a/connection.cpp
+++ b/connection.cpp
@@ -244,7 +244,8 @@ void QubicConnection::receivePacketWithHeaderAs(T& result)
     memset(&result, 0, sizeof(T));
     if (remainingSize)
     {
-		std::fill_n(mBuffer.begin(), remainingSize, 0);
+        // Only fill the part read back into result; receiveData() rejects an oversized size.
+        std::fill_n(mBuffer.begin(), sizeof(T), 0);
         receiveAllDataOrThrowException(mBuffer, remainingSize);
         result = *((T*)mBuffer.data());
     }