From 5b20792e3c12f80fdd04e4638a1fb62df08bb342 Mon Sep 17 00:00:00 2001
From: Bulat Fatykh <68301540+gitoutofthere@users.noreply.github.com>
Date: Thu, 1 Oct 2026 01:28:56 +0300
Subject: [PATCH] Check a snapshot delta's length against its frame before
 allocating it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/net/src/transport/delta.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crates/net/src/transport/delta.rs b/crates/net/src/transport/delta.rs
index 2d70472..67319d7 100644
--- a/crates/net/src/transport/delta.rs
+++ b/crates/net/src/transport/delta.rs
@@ -29,6 +29,9 @@ impl SnapshotDelta {
     pub fn decode(input: &mut WireReader<'_>) -> Result<Self, WireError> {
         let tick = Tick(input.get_u32()?);
         let length = input.get_u32()? as usize;
+        if length > input.remaining() {
+            return Err(WireError::Malformed("snapshot delta longer than its frame"));
+        }
         let mut bytes = vec![0u8; length];
         input.get_bytes(&mut bytes)?;
         Ok(Self { tick, bytes })