CyclopsMC / CyclopsCore / #479033859

23%

master-1.21: 31%

Pull #260

github

Bound list and map sizes and avoid class init when decoding packets

The List, Map and Pair codecs read sizes and class names from the
packet. A small packet could make the decoder allocate very large lists,
and Class.forName initialized any class named in the packet.

Collection sizes are now bounded by the remaining packet bytes, the
number of (unencoded) null list elements is limited, list indices must
increase within the list size, and classes are loaded without
initialization and must have a codec action. Invalid input throws a
DecoderException instead of being logged.

Fixes GHSA-4jfp-83qj-mr8r

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UeSuG5REz2JxHTZADcGhh2

44 of 49 new or added lines in 1 file covered. (89.8%)

2470 of 10614 relevant lines covered (23.27%)

0.23 hits per line