Fix: HessianCodec failed to check package header length(issue #380)

.travis.yml

@@ -5,7 +5,6 @@ os:
   - osx
 
 go:
-  - "1.12"
   - "1.13"
 
 env:

protocol/dubbo/codec.go

@@ -83,7 +83,13 @@ func (p *DubboPackage) Marshal() (*bytes.Buffer, error) {
 
 // Unmarshal ...
 func (p *DubboPackage) Unmarshal(buf *bytes.Buffer, opts ...interface{}) error {
-	codec := hessian.NewHessianCodec(bufio.NewReaderSize(buf, buf.Len()))
+	// fix issue https://github.com/apache/dubbo-go/issues/380
+	bufLen := buf.Len()
+	if bufLen < hessian.HEADER_LENGTH {
+		return perrors.WithStack(hessian.ErrHeaderNotEnough)
+	}
+
+	codec := hessian.NewHessianCodec(bufio.NewReaderSize(buf, bufLen))
 
 	// read header
 	err := codec.ReadHeader(&p.Header)

protocol/dubbo/codec_test.go

@@ -18,12 +18,14 @@
 package dubbo
 
 import (
+	"bytes"
 	"testing"
 	"time"
 )
 
 import (
 	hessian "github.com/apache/dubbo-go-hessian2"
+	perrors "github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -72,3 +74,10 @@ func TestDubboPackage_MarshalAndUnmarshal(t *testing.T) {
 	assert.Equal(t, []interface{}{"a"}, pkgres.Body.([]interface{})[5])
 	assert.Equal(t, map[string]string{"dubbo": "2.0.2", "interface": "Service", "path": "path", "timeout": "1000", "version": "2.6"}, pkgres.Body.([]interface{})[6])
 }
+
+func TestIssue380(t *testing.T) {
+	pkg := &DubboPackage{}
+	buf := bytes.NewBuffer([]byte("hello"))
+	err := pkg.Unmarshal(buf)
+	assert.True(t, perrors.Cause(err) == hessian.ErrHeaderNotEnough)
+}