fix: hardening

src/Ber/Reader.ts

@@ -101,6 +101,13 @@ class ExtendedReader extends Reader {
 
 		significand = significand.shl(significandShift)
 
+		// A zero significand represents the value zero and cannot be normalised;
+		// the loops below would spin forever on it. Non-canonical / crafted REALs
+		// can reach this point, so guard explicitly.
+		if (significand.isZero()) {
+			return sign < 0 ? -0 : 0
+		}
+
 		while (significand.and(Long.fromBits(0x00000000, 0x7ffff000, true)).eq(0)) {
 			significand = significand.shl(8)
 		}

src/Ber/__tests__/reader.spec.ts

@@ -0,0 +1,33 @@
+import { Writer } from '../Writer'
+import { BERDataTypes } from '../BERDataTypes'
+import { Reader } from '../Reader'
+
+describe('BER Reader.readReal', () => {
+	// Regression for the infinite-loop DoS: a non-canonical REAL with an explicit
+	// all-zero significand must short-circuit to 0 rather than spin the
+	// normalisation loops forever. Tight timeout so a regression fails fast.
+	test('zero-significand REAL returns 0 quickly', () => {
+		// 09 (REAL tag) 03 (length) 00 (preamble) 00 (exponent) 00 (significand)
+		const buf = Buffer.from([BERDataTypes.REAL, 0x03, 0x00, 0x00, 0x00])
+
+		const r = new Reader(buf)
+		expect(r.readReal()).toEqual(0)
+	}, 2000)
+
+	test('zero-significand REAL via readValue returns 0 quickly', () => {
+		const buf = Buffer.from([BERDataTypes.REAL, 0x03, 0x00, 0x00, 0x00])
+
+		const r = new Reader(buf)
+		expect(r.readValue().value).toEqual(0)
+	}, 2000)
+
+	test('normal REAL values still decode', () => {
+		for (const value of [8.32, -8.32, 1, -1, 1234.5, 0.0001]) {
+			const w = new Writer()
+			w.writeReal(value, BERDataTypes.REAL)
+
+			const r = new Reader(w.buffer)
+			expect(r.readReal()).toBeCloseTo(value)
+		}
+	})
+})

src/Ember/Socket/S101Client.ts

@@ -2,6 +2,7 @@ import net from 'net'
 import S101Socket from './S101Socket'
 import { ConnectionStatus } from '../Client/ConnectionStatus'
 import { normalizeError } from '../Lib/util'
+import { S101OversizedFrameError } from '../../Errors'
 
 import Debug from 'debug'
 const debug = Debug('emberplus-connection:S101Client')
@@ -72,6 +73,10 @@ export default class S101Client extends S101Socket {
 							this.codec.dataIn(data)
 						} catch (e) {
 							this.emit('error', normalizeError(e))
+							if (e instanceof S101OversizedFrameError) {
+								// Abusive/broken peer - drop the connection instead of continuing to buffer.
+								this.handleClose()
+							}
 						}
 					})
 					this.socket.on('error', (error) => this._onError(error))

src/Ember/Socket/S101Socket.ts

@@ -5,6 +5,7 @@ import { S101Codec } from '../../S101'
 import { berDecode } from '../../encodings/ber'
 import { ConnectionStatus } from '../Client/ConnectionStatus'
 import { normalizeError } from '../Lib/util'
+import { S101OversizedFrameError } from '../../Errors'
 import { Root } from '../../types'
 import { DecodeResult } from '../../encodings/ber/decoder/DecodeResult'
 
@@ -77,6 +78,10 @@ export default class S101Socket extends EventEmitter<S101SocketEvents> {
 					this.codec.dataIn(data)
 				} catch (e) {
 					this.emit('error', normalizeError(e))
+					if (e instanceof S101OversizedFrameError) {
+						// Abusive/broken peer - drop the connection instead of continuing to buffer.
+						this.socket?.destroy()
+					}
 				}
 			})
 

src/Ember/Socket/__tests__/S101Socket.spec.ts

@@ -1,7 +1,12 @@
-import { EventEmitter } from 'eventemitter3'
+// Import the package barrel first: S101Socket has a circular dependency on it
+// (for berDecode), so loading it directly first leaves the class undefined.
+import '../../..'
+import { EventEmitter } from 'events'
+import type { Socket } from 'net'
 import S101Socket from '../S101Socket'
 import { ConnectionStatus } from '../../Client/ConnectionStatus'
 
+// Minimal stand-in for net.Socket: enough to drive the 'data' path and observe destroy().
 class FakeSocket extends EventEmitter {
 	public destroyed = false
 	public wrote: Buffer[] = []
@@ -22,6 +27,40 @@ class FakeSocket extends EventEmitter {
 	}
 }
 
+describe('S101Socket abusive-peer handling', () => {
+	test('oversized frame disconnects the peer and emits error', () => {
+		const fake = new FakeSocket()
+		const socket = new S101Socket(fake as unknown as Socket)
+
+		const errors: Error[] = []
+		socket.on('error', (e) => errors.push(e))
+
+		// Begin-of-frame then an endless stream of non-EOF bytes.
+		fake.emit('data', Buffer.from([0xfe]))
+		const chunk = Buffer.alloc(1024 * 1024) // 1 MB of zeros, no 0xff
+		for (let i = 0; i < 8 && !fake.destroyed; i++) {
+			fake.emit('data', chunk)
+		}
+
+		expect(fake.destroyed).toBe(true)
+		expect(errors.some((e) => /oversized/i.test(e.message))).toBe(true)
+	}, 5000)
+
+	test('a single bad-CRC frame emits error but does NOT disconnect', () => {
+		const fake = new FakeSocket()
+		const socket = new S101Socket(fake as unknown as Socket)
+
+		const errors: Error[] = []
+		socket.on('error', (e) => errors.push(e))
+
+		// Complete frame (BOF .. EOF) with garbage contents -> CRC failure.
+		fake.emit('data', Buffer.from([0xfe, 0x00, 0x0e, 0x00, 0x01, 0xff]))
+
+		expect(errors.length).toBeGreaterThan(0)
+		expect(fake.destroyed).toBe(false)
+	})
+})
+
 describe('S101Socket lifecycle', () => {
 	it('sets disconnected status on socket close', () => {
 		const socket = new FakeSocket()

src/Errors.ts

@@ -19,6 +19,7 @@ export {
 	InvalidRequesrFormat,
 	InvalidStringPair,
 	PathDiscoveryFailure,
+	S101OversizedFrameError,
 }
 
 class UnimplementedEmberTypeError extends Error {
@@ -47,6 +48,18 @@ class S101SocketError extends Error {
 	}
 }
 
+/**
+ * Thrown by the S101 codec when an inbound frame or multi-packet message
+ * exceeds the configured size limits, indicating an abusive/broken peer.
+ * The socket layer recognises this type to drop the connection.
+ */
+class S101OversizedFrameError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = this.constructor.name
+	}
+}
+
 class ASN1Error extends Error {
 	constructor(message: string | undefined) {
 		super(message)

src/S101/S101Codec.ts

@@ -3,6 +3,7 @@ import { SmartBuffer } from 'smart-buffer'
 import Debug from 'debug'
 import { format } from 'util'
 import { berDecode } from '../encodings/ber'
+import { S101OversizedFrameError } from '../Errors'
 
 const debug = Debug('emberplus-connection:S101Codec')
 
@@ -65,6 +66,14 @@ export type S101CodecEvents = {
 // This is enough for typical size of Ember data, but buffer is Dynamic to allow for larger data if needed
 const BUFFER_FRAME_SIZE = 64 * 1024
 
+// Largest in-progress single S101 frame we will buffer before treating the
+// peer as abusive. Legitimate large payloads arrive via multi-packet
+// reassembly, so a single frame never needs to approach this. Tune as needed.
+const MAX_FRAME_BUFFER_SIZE = 4 * 1024 * 1024
+
+// Largest reassembled multi-packet Ember message we will accept.
+const MAX_MULTI_PACKET_SIZE = 16 * 1024 * 1024
+
 export default class S101Codec extends EventEmitter<S101CodecEvents> {
 	inbuf = new SmartBuffer({ size: BUFFER_FRAME_SIZE })
 	private frameBuffer?: Buffer
@@ -90,7 +99,17 @@ export default class S101Codec extends EventEmitter<S101CodecEvents> {
 			const frameEnd = buf.indexOf(S101_EOF, frameStart + 1)
 			if (frameEnd === -1 || frameEnd - frameStart < 4) {
 				//console.log('Parsing frameEnd to next chunk')
-				this.frameBuffer = buf.subarray(frameStart)
+				const pending = buf.subarray(frameStart)
+				if (pending.length > MAX_FRAME_BUFFER_SIZE) {
+					// Clear state before throwing so the next dataIn call starts clean.
+					this.frameBuffer = undefined
+					this.escaped = false
+					this.resetMultiPacketBuffer()
+					throw new S101OversizedFrameError(
+						format('dropping oversized S101 frame: %d bytes buffered without EOF', pending.length)
+					)
+				}
+				this.frameBuffer = pending
 				break
 			}
 
@@ -232,9 +251,23 @@ export default class S101Codec extends EventEmitter<S101CodecEvents> {
 				this.multiPacketBuffer = new SmartBuffer()
 				this.isMultiPacket = true
 				this.multiPacketBuffer.writeBuffer(payload)
+
+				if (this.multiPacketBuffer.length > MAX_MULTI_PACKET_SIZE) {
+					this.resetMultiPacketBuffer()
+					throw new S101OversizedFrameError(
+						format('dropping oversized multi-packet message: exceeded %d bytes', MAX_MULTI_PACKET_SIZE)
+					)
+				}
 			} else if (this.isMultiPacket && this.multiPacketBuffer) {
 				this.multiPacketBuffer.writeBuffer(payload)
 
+				if (this.multiPacketBuffer.length > MAX_MULTI_PACKET_SIZE) {
+					this.resetMultiPacketBuffer()
+					throw new S101OversizedFrameError(
+						format('dropping oversized multi-packet message: exceeded %d bytes', MAX_MULTI_PACKET_SIZE)
+					)
+				}
+
 				if ((flags & FLAG_LAST_MULTI_PACKET) === FLAG_LAST_MULTI_PACKET) {
 					debug('multi ember packet end')
 					const completeData = this.multiPacketBuffer.toBuffer()

src/S101/__tests__/S101Codec.spec.ts

@@ -0,0 +1,73 @@
+import { SmartBuffer } from 'smart-buffer'
+import S101Codec from '../S101Codec'
+
+const FLAG_FIRST_MULTI_PACKET = 0x80
+const FLAG_MULTI_PACKET = 0x00
+
+// Build a raw ember frame in the shape handleEmberFrame() expects:
+// version, flags, dtd, appBytes, 2 app bytes, payload, then 2 CRC bytes
+// (handleEmberFrame strips the trailing 2 bytes as CRC).
+function makeEmberFrame(flags: number, payload: Buffer): SmartBuffer {
+	const sb = new SmartBuffer()
+	sb.writeUInt8(0x01) // version
+	sb.writeUInt8(flags)
+	sb.writeUInt8(0x01) // dtd (glow)
+	sb.writeUInt8(2) // number of app bytes
+	sb.writeUInt8(0x1f) // dtd minor version
+	sb.writeUInt8(0x02) // dtd major version
+	sb.writeBuffer(payload)
+	sb.writeUInt8(0x00) // CRC lo (stripped)
+	sb.writeUInt8(0x00) // CRC hi (stripped)
+	return sb
+}
+
+describe('S101Codec DoS hardening', () => {
+	test('unterminated frame is dropped, not buffered unbounded', () => {
+		const codec = new S101Codec()
+
+		// Begin-of-frame, then a stream of non-EOF bytes that never completes a frame.
+		codec.dataIn(Buffer.from([0xfe]))
+
+		const chunk = Buffer.alloc(1024 * 1024) // 1 MB of zeros, no 0xff
+		expect(() => {
+			for (let i = 0; i < 8; i++) {
+				codec.dataIn(chunk)
+			}
+		}).toThrow(/oversized/i)
+
+		// State must be reset so the next dataIn starts clean.
+		expect((codec as any).frameBuffer).toBeUndefined()
+	}, 5000)
+
+	test('unterminated multi-packet message is dropped', () => {
+		const codec = new S101Codec()
+
+		const payload = Buffer.alloc(1024 * 1024) // 1 MB per frame
+
+		// Start a multi-packet message...
+		codec.handleEmberFrame(makeEmberFrame(FLAG_FIRST_MULTI_PACKET, payload))
+
+		// ...then stream continuation frames that never set the last-flag.
+		expect(() => {
+			for (let i = 0; i < 32; i++) {
+				codec.handleEmberFrame(makeEmberFrame(FLAG_MULTI_PACKET, payload))
+			}
+		}).toThrow(/oversized/i)
+
+		// Reassembly state must be reset.
+		expect((codec as any).multiPacketBuffer).toBeUndefined()
+		expect((codec as any).isMultiPacket).toBe(false)
+	}, 5000)
+
+	test('sanity: a normal well-formed frame still decodes and emits', () => {
+		const codec = new S101Codec()
+
+		const events: string[] = []
+		codec.on('keepaliveReq', () => events.push('req'))
+
+		// keepAliveRequest() produces a complete, CRC-valid S101 frame.
+		codec.dataIn(codec.keepAliveRequest())
+
+		expect(events).toEqual(['req'])
+	})
+})