Message.readBytes(): Fail fast if length is too large

Cherry pick bitcoinj@694955c
oscarguindzberg · Jan 3, 2019 · edef6ef · edef6ef
1 parent d5d3e39
commit edef6ef
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/core/src/main/java/org/bitcoinj/core/Message.java b/core/src/main/java/org/bitcoinj/core/Message.java
@@ -327,7 +327,7 @@ protected long readVarInt(int offset) throws ProtocolException {
     }
 
     protected byte[] readBytes(int length) throws ProtocolException {
-        if (length > MAX_SIZE) {
+        if ((length > MAX_SIZE) || (cursor + length > payload.length)) {
             throw new ProtocolException("Claimed value length too large: " + length);
         }
         try {