crypto/attachment: Check dst bounds on encrypted read

mautrix · Dec 12, 2024 · bec2c1e · bec2c1e
1 parent 9593f72
commit bec2c1e
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/crypto/attachment/attachments.go b/crypto/attachment/attachments.go
@@ -198,6 +198,9 @@ func (r *encryptingReader) Seek(offset int64, whence int) (int64, error) {
 }
 
 func (r *encryptingReader) Read(dst []byte) (n int, err error) {
+	if len(dst) < n {
+		return 0, io.ErrUnexpectedEOF
+	}
 	if r.closed {
 		return 0, ReaderClosed
 	} else if r.isDecrypting && r.file.decoded == nil {