fix: The final frame can not be larger than the Frame Length

modules/serialize/src/decode_body_header.ts

@@ -155,6 +155,8 @@ export function decodeFinalFrameBodyHeader (buffer: Uint8Array, headerInfo: Head
   needs(sequenceNumber > 0, 'Malformed sequenceNumber.')
   const iv = buffer.slice(readPos += 4, readPos += ivLength)
   const contentLength = dataView.getUint32(readPos)
+  /* Postcondition: The final frame MUST NOT exceed the frameLength. */
+  needs(headerInfo.messageHeader.frameLength >= contentLength, 'Final frame length exceeds frame length.')
   return {
     sequenceNumber,
     iv,

modules/serialize/test/decode_body_header.test.ts

@@ -102,7 +102,7 @@ describe('decodeFrameBodyHeader', () => {
   it('return final frame header', () => {
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -206,7 +206,7 @@ describe('decodeFrameBodyHeader', () => {
     const buffer = concatBuffers(new Uint8Array(10), fixtures.finalFrameHeader())
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -297,7 +297,7 @@ describe('decodeFinalFrameBodyHeader', () => {
   it('return final frame header from readPos', () => {
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -319,12 +319,36 @@ describe('decodeFinalFrameBodyHeader', () => {
     expect(test.tagLength).to.eql(16)
     expect(test.isFinalFrame).to.eql(true)
     expect(test.contentType).to.eql(ContentType.FRAMED_DATA)
+    expect(test.contentLength).to.eql(999)
+  })
+
+  it('The final frame can be 0 length.', () => {
+    const headerInfo = {
+      messageHeader: {
+        frameLength: 999,
+        contentType: ContentType.FRAMED_DATA
+      },
+      algorithmSuite: {
+        ivLength: 12,
+        tagLength: 16
+      }
+    } as any
+    const buffer = fixtures.finalFrameHeaderZeroBytes()
+
+    const test = decodeFinalFrameBodyHeader(buffer, headerInfo, 0)
+    if (!test) throw new Error('failure')
+    expect(test.sequenceNumber).to.eql(1)
+    expect(test.iv).to.eql(fixtures.basicFrameIV())
+    expect(test.tagLength).to.eql(16)
+    expect(test.isFinalFrame).to.eql(true)
+    expect(test.contentType).to.eql(ContentType.FRAMED_DATA)
+    expect(test.contentLength).to.eql(0)
   })
 
   it('Precondition: The contentType must be FRAMED_DATA to be a Final Frame.', () => {
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: 'not FRAMED_DATA'
       },
       algorithmSuite: {
@@ -339,7 +363,7 @@ describe('decodeFinalFrameBodyHeader', () => {
   it('Precondition: decodeFinalFrameBodyHeader readPos must be within the byte length of the buffer given.', () => {
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -356,7 +380,7 @@ describe('decodeFinalFrameBodyHeader', () => {
   it('Postcondition: sequenceEnd must be SEQUENCE_NUMBER_END.', () => {
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -372,7 +396,7 @@ describe('decodeFinalFrameBodyHeader', () => {
   it('Postcondition: decodeFinalFrameBodyHeader sequenceNumber must be greater than 0.', () => {
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -389,7 +413,7 @@ describe('decodeFinalFrameBodyHeader', () => {
     const frameHeader = fixtures.finalFrameHeader()
     const headerInfo = {
       messageHeader: {
-        frameLength: 99,
+        frameLength: 999,
         contentType: ContentType.FRAMED_DATA
       },
       algorithmSuite: {
@@ -403,6 +427,24 @@ describe('decodeFinalFrameBodyHeader', () => {
       expect(test).to.eql(false)
     }
   })
+
+  it('Postcondition: The final frame MUST NOT exceed the frameLength.', () => {
+    const headerInfo = {
+      messageHeader: {
+        // The content length in this final frame is 999
+        // So I set the frame length to less than this
+        frameLength: 99,
+        contentType: ContentType.FRAMED_DATA
+      },
+      algorithmSuite: {
+        ivLength: 12,
+        tagLength: 16
+      }
+    } as any
+    const buffer = fixtures.finalFrameHeader()
+
+    expect(() => decodeFinalFrameBodyHeader(buffer, headerInfo, 0)).to.throw('Final frame length exceeds frame length.')
+  })
 })
 
 describe('decodeNonFrameBodyHeader', () => {

modules/serialize/test/fixtures.ts

@@ -61,6 +61,10 @@ export function finalFrameHeader () {
   return new Uint8Array([255, 255, 255, 255, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 3, 231])
 }
 
+export function finalFrameHeaderZeroBytes () {
+  return new Uint8Array([255, 255, 255, 255, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0])
+}
+
 export function invalidSequenceEndFinalFrameHeader () {
   return new Uint8Array([0, 255, 255, 255, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 3, 231])
 }