[Audit-Medium] Protobuf envelope validation is incomplete and misclas…

[pepone]

AI-generated audit finding — this issue was opened from an automated security/correctness audit. It has not been triaged by a human yet; verify the reasoning, reproducibility, and severity before acting on it.

Medium: Protobuf envelope validation is incomplete and misclassifies malformed input — CONFIRMED

Affected code:

• src/IceRpc.Protobuf/RpcMethods/Internal/PipeReaderExtensions.cs:110-113 — only rejects compression flag 1; throws NotSupportedException
• src/IceRpc.Protobuf/RpcMethods/Internal/PipeReaderExtensions.cs:114 — DecodeMessageLength uses BinaryPrimitives.ReadInt32BigEndian (signed)
• src/IceRpc.Protobuf/RpcMethods/Internal/PipeReaderExtensions.cs:121 — signed length passed to ReadAtLeastAsync without a non-negative check
• src/IceRpc/Internal/IceRpcProtocolConnection.cs:1208, src/IceRpc/Internal/IceProtocolConnection.cs:1051 — non-InvalidDataException decode failures map to InternalError

Verification:

Confirmed. Three independent issues in the same 5-byte envelope validation:

1. The compression flag byte is only rejected for the exact value 1. Values 2..255 are silently accepted as "uncompressed" even though they violate the envelope contract.
2. When the flag is 1, the throw is NotSupportedException rather than InvalidDataException. The protocol connection maps that to InternalError instead of a clean malformed-input response.
3. The length is decoded with ReadInt32BigEndian (signed). A peer sending a high bit yields a negative messageLength, which propagates to reader.ReadAtLeastAsync(messageLength, …) — that method throws ArgumentOutOfRangeException for negative minimum sizes, again mis-mapped to InternalError.

Impact:

• Malformed peer input surfaces as InternalError instead of InvalidData.
• Server-side error reporting becomes inconsistent for bad Protobuf payloads.
• Client-side callers may see raw framework exceptions for malformed envelopes.

Recommendation:

• Reject any nonzero compression flag with InvalidDataException.
• Reject messageLength < 0 with InvalidDataException before ReadAtLeastAsync.
• Keep all malformed-envelope failures inside the InvalidDataException boundary.
• Add regression tests for: compression flag 1, flag values in 2..255, and negative encoded lengths.

Status: Valid, Medium severity.

---

Source report: src-IceRpc.Protobuf-audit-2026-04-14.md (finding Protobuf envelope validation is incomplete and misclassifies malformed input — **CONFIRMED**)

Severity (auditor-assigned): Medium