From ccc6d0857f6a13aaad0aa6545f02bf41c43a391f Mon Sep 17 00:00:00 2001
From: Levi Neely <lkn@darkstar.example.net>
Date: Tue, 3 Mar 2026 15:48:20 +0100
Subject: [PATCH] Add POVERLAY_BUFSIZE bounds check in prpc.c read loop

Check request->length <= POVERLAY_BUFSIZE after casting request
and before continuing to read. Prevents buffer overflow if client
sends oversized length field.

Fixes #247
---
 pclsync/prpc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pclsync/prpc.c b/pclsync/prpc.c
index 6b953fe..1c0cf89 100644
--- a/pclsync/prpc.c
+++ b/pclsync/prpc.c
@@ -86,6 +86,11 @@ static void on_request(void *lpvParam) {
     rqbufp = rqbufp + rc;
     if (readbytes > 12) {
       request = (rpc_message_t *)rqbuf;
+      if (request->length > POVERLAY_BUFSIZE) {
+        pdbg_logf(D_ERROR, "Request length %lu exceeds buffer size %d",
+                  (unsigned long)request->length, POVERLAY_BUFSIZE);
+        goto cleanup;
+      }
       if (request->length == (uint64_t)readbytes)
         break;
     }