{"record":{"id":"badace258226a862","repo":"txthinking/brook","slug":"data-too-long","errorCode":null,"errorMessage":"data too long","messagePattern":"data too long","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"simplestreamserver.go","lineNumber":59,"sourceCode":"\t\tif err := client.SetDeadline(time.Now().Add(time.Duration(timeout) * time.Second)); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\ts := &SimpleStreamServer{Client: client, Timeout: timeout, src: src}\n\tb := x.BP2048.Get().([]byte)\n\tif _, err := io.ReadFull(s.Client, b[:32+2]); err != nil {\n\t\tx.BP2048.Put(b)\n\t\treturn nil, err\n\t}\n\tif bytes.Compare(password, b[:32]) != 0 {\n\t\tx.BP2048.Put(b)\n\t\tWaitReadErr(s.Client)\n\t\treturn nil, errors.New(\"Password is wrong\")\n\t}\n\tl := int(binary.BigEndian.Uint16(b[32:34]))\n\tif l > 2048 {\n\t\tx.BP2048.Put(b)\n\t\treturn nil, errors.New(\"data too long\")\n\t}\n\tif _, err := io.ReadFull(s.Client, b[:l]); err != nil {\n\t\tx.BP2048.Put(b)\n\t\treturn nil, err\n\t}\n\ti := int64(binary.BigEndian.Uint32(b[:4]))\n\tif time.Now().Unix()-i > 60 {\n\t\tx.BP2048.Put(b)\n\t\tWaitReadErr(s.Client)\n\t\treturn nil, errors.New(\"Expired request\")\n\t}\n\tif i%2 == 0 {\n\t\ts.network = \"tcp\"\n\t\ts.RB = b\n\t\ts.WB = x.BP2048.Get().([]byte)\n\t}\n\tif i%2 == 1 {\n\t\ts.network = \"udp\"","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/txthinking/brook/blob/5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8/simplestreamserver.go#L41-L77","documentation":"NewSimpleStreamServer reads a 2-byte length at b[32:34] and rejects values greater than 2048 with 'data too long', since the remainder cannot fit in the fixed 2048-byte pool buffer. This guards against buffer overflow from malformed or malicious length fields.","triggerScenarios":"The client writes a length prefix larger than 2048 (or a >16-bit-integer/garbage value lands at b[32:34]) in the handshake — a protocol violation, version mismatch, or a hostile client crafting a huge length.","commonSituations":"Client protocol version writing a different handshake layout (length at wrong offset); corrupted stream causing misaligned reads; attacker sending oversized length to probe the server; client sends raw address without the expected length framing.","solutions":["Ensure the client writes the exact handshake layout: 32-byte password hash, then BigEndian uint16 length of the address at offset 32","Check both ends run the same protocol version and same code path (tcp vs http wrapping)","Log the offending l value and source IP to identify misbehaving or malicious clients","Cap the address size on the client well below 2048 before sending"],"exampleFix":"// before (client, wrong layout)\nbinary.BigEndian.PutUint16(b[34:36], uint16(len(dst)))\n// after\nbinary.BigEndian.PutUint16(b[32:34], uint16(len(dst)))","handlingStrategy":"validation","validationCode":"if len(dst) > 2048 {\n    return errors.New(\"destination exceeds protocol handshake limit of 2048 bytes\")\n}","typeGuard":null,"tryCatchPattern":"s, err := NewSimpleStreamServer(password, conn, ...)\nif err != nil && err.Error() == \"data too long\" {\n    log.Printf(\"malformed handshake (oversized length) from %s\", conn.RemoteAddr())\n    conn.Close()\n}","preventionTips":["Match the client handshake layout exactly (hash, then uint16 length at offset 32)","Keep addresses well below 2048 bytes on the client","Use the same protocol version on both ends","Log and monitor oversized-length rejections as potential attacks"],"tags":["validation","buffer-limit","protocol","handshake"],"backgroundTag":"payload-too-large","analyzedSha":"5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8","analyzedAt":"2026-09-06T04:35:00.432Z","contentChangedAt":"2026-09-06T04:35:00.432Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}