PVA: harden handling of protocol sizes

core/pva/src/main/java/org/epics/pva/client/ClientUDPHandler.java

@@ -61,7 +61,7 @@ public interface SearchResponseHandler
          *  @param server Server that replied to a search request
          *  @param version Server version
          *  @param guid  Globally unique ID of the server
-         *  @param tcp Does server require TLS?
+         *  @param tls Does server require TLS?
          */
         void handleSearchResponse(int channel_id, InetSocketAddress server, int version, Guid guid, boolean tls);
     }
@@ -250,15 +250,15 @@ private boolean handleBeacon(final InetSocketAddress from, final byte version,
         else
             server = new InetSocketAddress(addr, port);
 
-        final String protocol = PVAString.decodeString(buffer);
-        if (! "tcp".equals(protocol))
-        {
-            logger.log(Level.WARNING, "PVA Server " + from + " sent beacon for protocol '" + protocol + "'");
-            return false;
-        }
-
         try
         {
+            final String protocol = PVAString.decodeString(buffer);
+            if (! "tcp".equals(protocol))
+            {
+                logger.log(Level.WARNING, "PVA Server " + from + " sent beacon for protocol '" + protocol + "'");
+                return false;
+            }
+
             // Decode optional server status (likely null)
             final PVATypeRegistry types = new PVATypeRegistry();
             final PVAData server_status = types.decodeType("", buffer);

core/pva/src/main/java/org/epics/pva/common/PVAHeader.java

@@ -213,6 +213,17 @@
 
         // Application messages are followed by this number of data bytes
         final int payload = buffer.getInt(PVAHeader.HEADER_OFFSET_PAYLOAD_SIZE);
+        // Java implementation for now does not handle large 'unsigned' sizes,
+        // limited to the positive range of a signed int.
+        // Could use `Integer.toUnsignedLong(payload)`, but JDK API
+        // like buffer buffer.remaining() or buffer.get(10) is using int,
+        // so us updating to long would be of limited use
+        if (payload < 0)
+            throw new Exception("Payload size " + payload +
+                                " exceeds max signed integer " + Integer.toHexString(Integer.MAX_VALUE));
+        // Could check against a PVA variant of EPICS_CA_MAX_ARRAY_BYTES,
+        // but PVA design specifically aims to use all available memory
+        // without self-enforced limitations (confirmed in 2026-07-10 EPICS code telecon)
 
         // Total message size: Header followed by data
         return PVAHeader.HEADER_SIZE + payload;

core/pva/src/main/java/org/epics/pva/common/SearchRequest.java

@@ -151,7 +151,7 @@
         }
         catch (Exception ex)
         {
             logger.log(Level.WARNING, "PVA Client " + from + " sent search #" + search.seq + " with invalid address");
             return null;
         }
         int port = Short.toUnsignedInt(buffer.getShort());
@@ -173,15 +173,23 @@
         boolean tcp = search.tls = false;
         int count = Byte.toUnsignedInt(buffer.get());
         String unknown_protocol = "<none>";
-        for (int i=0; i<count; ++i)
+        try
         {
-            final String protocol = PVAString.decodeString(buffer);
-            if ("tls".equals(protocol))
-                search.tls = true;
-            else if ("tcp".equals(protocol))
-                tcp = true;
-            else
-                unknown_protocol = protocol;
+            for (int i=0; i<count; ++i)
+            {
+                final String protocol = PVAString.decodeString(buffer);
+                if ("tls".equals(protocol))
+                    search.tls = true;
+                else if ("tcp".equals(protocol))
+                    tcp = true;
+                else
+                    unknown_protocol = protocol;
+            }
+        }
+        catch (Exception ex)
+        {
+            logger.log(Level.WARNING, ex, () -> "PVA Client " + from + " sent search #" + search.seq + " with invalid protocol");
+            return null;
         }
 
         // Loop over searched channels
@@ -200,18 +208,26 @@
                 return null;
             }
             search.channels = new ArrayList<>(count);
-            for (int i=0; i<count; ++i)
+            try
             {
-                final int cid = buffer.getInt();
-                final String name = PVAString.decodeString(buffer);
-                logger.log(Level.FINER, () -> "PVA Client " + from + " sent search #" + search.seq + " for " + name + " [cid " + cid + "]"
-                                            + ", reply addr " + orig_response_addr
-                                            + (orig_response_addr.equals(search.client) ? "" : ", using " + search.client)
-                                            + (search.tls               ? " (TLS)" : "")
-                                            + (search.unicast           ? " (unicast)" : "")
-                                            + (search.reply_required    ? " (reply required)" : "")
-                                            + (search.reply_to_src_port ? (origin == null ?  " (reply to source port)"  : " (reply to source port ignored because of origin tag)") : ""));
-                search.channels.add(new Channel(cid, name));
+                for (int i=0; i<count; ++i)
+                {
+                    final int cid = buffer.getInt();
+                    final String name = PVAString.decodeString(buffer);
+                    logger.log(Level.FINER, () -> "PVA Client " + from + " sent search #" + search.seq + " for " + name + " [cid " + cid + "]"
+                            + ", reply addr " + orig_response_addr
+                            + (orig_response_addr.equals(search.client) ? "" : ", using " + search.client)
+                            + (search.tls               ? " (TLS)" : "")
+                            + (search.unicast           ? " (unicast)" : "")
+                            + (search.reply_required    ? " (reply required)" : "")
+                            + (search.reply_to_src_port ? (origin == null ? " (reply to source port)" : " (reply to source port ignored because of origin tag)") : ""));
+                    search.channels.add(new Channel(cid, name));
+                }
+            }
+            catch (Exception ex)
+            {
+                logger.log(Level.WARNING, ex, () -> "PVA Client " + from + " sent damaged search #" + search.seq);
+                return null;
             }
         }
 

core/pva/src/main/java/org/epics/pva/common/SearchResponse.java

@@ -97,6 +97,9 @@
         result.found = PVABool.decodeBoolean(buffer);
 
         final int count = Short.toUnsignedInt(buffer.getShort());
+        if (count*Integer.BYTES > buffer.remaining())
+            throw new Exception("PVA Server sent search reply #" + result.seq + " for " + count + " CIDs " +
+                                " with only " + buffer.remaining() + " bytes in buffer");
         result.cid = new int[count];
         for (int i=0; i<count; ++i)
             result.cid[i] = buffer.getInt();

core/pva/src/main/java/org/epics/pva/data/PVAAnyArray.java

@@ -128,6 +128,9 @@
     public void decode(PVATypeRegistry types, ByteBuffer buffer) throws Exception {
 
         final int count = PVASize.decodeSize(buffer);
+        // Each array element needs at least the 'non_null' byte
+        if (count < 0  ||  count > buffer.remaining())
+            throw new Exception("Array size " + count + " with only " + buffer.remaining() + " bytes in buffer");
         // Try to re-use elements
         PVAny[] new_elements = elements;
         if (new_elements == null  ||  new_elements.length != count)

core/pva/src/main/java/org/epics/pva/data/PVABitSet.java

@@ -27,10 +27,13 @@
 
     /** @param buffer Source buffer
      *  @return Decoded bits
+     *  @throws Exception on error
      */
-    public static BitSet decodeBitSet(final ByteBuffer buffer)
+    public static BitSet decodeBitSet(final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size > buffer.remaining())
+            throw new Exception("Bitset size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final byte[] bytes = new byte[size];
         buffer.get(bytes);
         return BitSet.valueOf(bytes);

core/pva/src/main/java/org/epics/pva/data/PVABoolArray.java

@@ -95,6 +95,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final boolean[] new_value = new boolean[size];
         for (int i=0; i<size; ++i)
             new_value[i] = buffer.get() != 0;

core/pva/src/main/java/org/epics/pva/data/PVAByteArray.java

@@ -114,6 +114,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final byte[] new_value = new byte[size];
         buffer.get(new_value);
         value = new_value;

core/pva/src/main/java/org/epics/pva/data/PVADoubleArray.java

@@ -98,6 +98,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size*Double.BYTES > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final double[] new_value = new double[size];
         for (int i=0; i<size; ++i)
             new_value[i] = buffer.getDouble();

core/pva/src/main/java/org/epics/pva/data/PVAFloatArray.java

@@ -99,6 +99,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size*Float.BYTES > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final float[] new_value = new float[size];
         for (int i=0; i<size; ++i)
             new_value[i] = buffer.getFloat();

core/pva/src/main/java/org/epics/pva/data/PVAIntArray.java

@@ -111,6 +111,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size*Integer.BYTES > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final int[] new_value = new int[size];
         for (int i=0; i<size; ++i)
             new_value[i] = buffer.getInt();

core/pva/src/main/java/org/epics/pva/data/PVALongArray.java

@@ -111,6 +111,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size*Long.BYTES > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         final long[] new_value = new long[size];
         for (int i=0; i<size; ++i)
             new_value[i] = buffer.getLong();

core/pva/src/main/java/org/epics/pva/data/PVAShortArray.java

@@ -111,6 +111,8 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        if (size < 0  ||  size*Short.BYTES > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         // Try to re-use existing array
         final short[] new_value = new short[size];
         // Considered using

core/pva/src/main/java/org/epics/pva/data/PVASize.java

@@ -54,6 +54,9 @@ else if (size < 254)
      */
     public static final int decodeSize(final ByteBuffer buffer)
     {
+        // XXXX Update to long, using Integer.toUnsignedLong(..)?
+        // JDK api like buffer.remaining() is limited to int,
+        // so this would have limited effect...
         byte b = buffer.get();
         if (b == -1)
             return -1;

core/pva/src/main/java/org/epics/pva/data/PVAStatus.java

@@ -72,8 +72,9 @@ public void encode(final ByteBuffer buffer)
 
     /** @param buffer Source buffer
      *  @return Decoded status
+     *  @throws Exception on error
      */
-    public static PVAStatus decode(final ByteBuffer buffer)
+    public static PVAStatus decode(final ByteBuffer buffer) throws Exception
     {
         final byte b = buffer.get();
         if (b == -1)

core/pva/src/main/java/org/epics/pva/data/PVAString.java

@@ -49,12 +49,16 @@
 
     /** @param buffer Buffer from which to decode string
      *  @return Decoded string
+     *  @throws Exception on error
      */
-    public static String decodeString(final ByteBuffer buffer)
+    public static String decodeString(final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
         if (size >= 0)
         {
+            if (size > buffer.remaining())
+                throw new Exception("PVAString size " + size +
+                                    " exceeds remaining buffer size " + buffer.remaining());
             byte[] bytes = new byte[size];
             buffer.get(bytes);
             return new String(bytes);

core/pva/src/main/java/org/epics/pva/data/PVAStringArray.java

@@ -89,6 +89,9 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int size = PVASize.decodeSize(buffer);
+        // Each array element needs to contain at least a byte for the string size
+        if (size < 0  ||  size > buffer.remaining())
+            throw new Exception("Array size " + size + " with only " + buffer.remaining() + " bytes in buffer");
         String[] new_value = value;
         if (new_value == null  ||  new_value.length != size)
             new_value = new String[size];

core/pva/src/main/java/org/epics/pva/data/PVAStructure.java

@@ -55,6 +55,10 @@
         // number of elements
         final int size = PVASize.decodeSize(buffer);
 
+        // Each element needs name (at least byte for length) and value (at least byte)
+        if (size < 0  ||  size*2 > buffer.remaining())
+            throw new Exception("Structure with " + size + " elements but only " + buffer.remaining() + " bytes in buffer");
+
         // (name, FieldDesc)[]
         final List<PVAData> values = new ArrayList<>(size);
         for (int i=0; i<size; ++i)

core/pva/src/main/java/org/epics/pva/data/PVAStructureArray.java

@@ -158,6 +158,11 @@
     public void decode(final PVATypeRegistry types, final ByteBuffer buffer) throws Exception
     {
         final int count = PVASize.decodeSize(buffer);
+
+        // Each element needs at least the 'non null' info byte
+        if (count < 0  ||  count > buffer.remaining())
+            throw new Exception("Structure element count " + count + " with only " + buffer.remaining() + " bytes in buffer");
+
         // Try to re-use elements
         PVAStructure[] new_elements = elements;
         if (new_elements == null  ||  new_elements.length != count)

core/pva/src/test/java/org/epics/pva/data/BitSetTest.java

@@ -18,7 +18,7 @@
 public class BitSetTest
 {
     @Test
-    public void testBitSet()
+    public void testBitSet() throws Exception
     {
         final ByteBuffer buffer = ByteBuffer.allocate(100);
         BitSet bits = new BitSet();