From 57770e3443f7e97e4d81ff769f3efd46a77fb1f5 Mon Sep 17 00:00:00 2001 From: ms-lead-reviewer Date: Fri, 17 Jul 2026 20:50:00 -0500 Subject: [PATCH] fix(#828): drain oversized broker frames safely closes #828 --- .../mosaic/framework/tools/lease-broker/daemon.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/packages/mosaic/framework/tools/lease-broker/daemon.py b/packages/mosaic/framework/tools/lease-broker/daemon.py index b909689..3ab417c 100644 --- a/packages/mosaic/framework/tools/lease-broker/daemon.py +++ b/packages/mosaic/framework/tools/lease-broker/daemon.py @@ -358,7 +358,16 @@ def read_frame(connection: socket.socket, deadline: float) -> dict[str, object]: if not chunk: break data.extend(chunk) - if len(data) > MAX_FRAME or not data.endswith(b"\n") or data.count(b"\n") != 1: + if len(data) > MAX_FRAME: + while True: + remaining = deadline - time.monotonic() + if remaining <= 0: + raise BrokerFailure("MALFORMED_REQUEST") + connection.settimeout(remaining) + if not connection.recv(4096): + break + raise BrokerFailure("MALFORMED_REQUEST") + if not data.endswith(b"\n") or data.count(b"\n") != 1: raise BrokerFailure("MALFORMED_REQUEST") try: value = json.loads(data)