@@ -38,20 +38,33 @@ public static function parseHandshakeResponse(Packet $packet): array
3838 {
3939 $ payload = $ packet ->getPayload ();
4040 $ offset = 0 ;
41+ $ payloadLength = strlen ($ payload );
4142
4243 // Capability Flags (4 bytes)
44+ if ($ offset + 4 > $ payloadLength ) {
45+ throw new \RuntimeException ('解析握手响应失败:数据包长度不足,无法读取 Capability Flags ' );
46+ }
4347 $ capabilities = unpack ('V ' , substr ($ payload , $ offset , 4 ))[1 ];
4448 $ offset += 4 ;
4549
4650 // Max Packet Size (4 bytes)
51+ if ($ offset + 4 > $ payloadLength ) {
52+ throw new \RuntimeException ('解析握手响应失败:数据包长度不足,无法读取 Max Packet Size ' );
53+ }
4754 $ maxPacketSize = unpack ('V ' , substr ($ payload , $ offset , 4 ))[1 ];
4855 $ offset += 4 ;
4956
5057 // Character Set (1 byte)
58+ if ($ offset + 1 > $ payloadLength ) {
59+ throw new \RuntimeException ('解析握手响应失败:数据包长度不足,无法读取 Character Set ' );
60+ }
5161 $ charset = ord ($ payload [$ offset ]);
5262 $ offset += 1 ;
5363
5464 // Reserved (23 bytes)
65+ if ($ offset + 23 > $ payloadLength ) {
66+ throw new \RuntimeException ('解析握手响应失败:数据包长度不足,无法读取 Reserved ' );
67+ }
5568 $ offset += 23 ;
5669
5770 // Username (NUL terminated string)
@@ -63,14 +76,21 @@ public static function parseHandshakeResponse(Packet $packet): array
6376 $ offset ++; // skip NUL
6477
6578 // Auth Response (length encoded integer)
79+ if ($ offset + 1 > $ payloadLength ) {
80+ throw new \RuntimeException ('解析握手响应失败:数据包长度不足,无法读取 Auth Response 长度 ' );
81+ }
6682 $ authResponseLength = ord ($ payload [$ offset ]);
6783 $ offset += 1 ;
84+
85+ if ($ offset + $ authResponseLength > $ payloadLength ) {
86+ throw new \RuntimeException ('解析握手响应失败:数据包长度不足,无法读取完整的 Auth Response ' );
87+ }
6888 $ authResponse = substr ($ payload , $ offset , $ authResponseLength );
6989 $ offset += $ authResponseLength ;
7090
7191 // Database (NUL terminated string) - only if CLIENT_CONNECT_WITH_DB
7292 $ database = '' ;
73- if ($ capabilities & 0x00000008 && $ offset < strlen ( $ payload ) ) {
93+ if ($ capabilities & 0x00000008 && $ offset < $ payloadLength ) {
7494 while (isset ($ payload [$ offset ]) && $ payload [$ offset ] !== "\x00" ) {
7595 $ database .= $ payload [$ offset ];
7696 $ offset ++;
@@ -80,7 +100,7 @@ public static function parseHandshakeResponse(Packet $packet): array
80100
81101 // Auth Plugin Name (NUL terminated string) - only if CLIENT_PLUGIN_AUTH
82102 $ authPluginName = '' ;
83- if ($ capabilities & 0x00080000 && $ offset < strlen ( $ payload ) ) {
103+ if ($ capabilities & 0x00080000 && $ offset < $ payloadLength ) {
84104 while (isset ($ payload [$ offset ]) && $ payload [$ offset ] !== "\x00" ) {
85105 $ authPluginName .= $ payload [$ offset ];
86106 $ offset ++;
0 commit comments