Implement string reading limits

src/main/java/ua/nanit/limbo/protocol/ByteMessage.java

@@ -22,6 +22,7 @@
 import io.netty.handler.codec.EncoderException;
 import io.netty.util.ByteProcessor;
 import net.kyori.adventure.nbt.*;
+import org.jetbrains.annotations.NotNull;
 import ua.nanit.limbo.protocol.registry.Version;
 
 import java.io.IOException;
@@ -107,13 +108,22 @@ private void writeVarIntFull(final int value) {
         }
     }
 
-    public String readString() {
-        return readString(readVarInt());
+    public @NotNull String readString() throws DecoderException {
+        return readString(Short.MAX_VALUE);
     }
 
-    public String readString(int length) {
-        String str = buf.toString(buf.readerIndex(), length, StandardCharsets.UTF_8);
-        buf.skipBytes(length);
+    public @NotNull String readString(int cap) throws DecoderException {
+        final int length = readVarInt();
+        return readString(cap, length);
+    }
+
+    public @NotNull String readString(int cap, int length) throws DecoderException {
+        if (length < 0) throw new DecoderException("Got a negative-length string");
+        if (length > cap * 3) throw new DecoderException("Bad string size");
+        if (!buf.isReadable(length)) throw new DecoderException("Tried to read a too-long string");
+        final String str = buf.toString(buf.readerIndex(), length, StandardCharsets.UTF_8);
+        buf.readerIndex(buf.readerIndex() + length);
+        if (str.length() > cap) throw new DecoderException("Got a too-long string");
         return str;
     }
 

src/main/java/ua/nanit/limbo/protocol/packets/PacketHandshake.java

@@ -55,7 +55,7 @@ public void decode(ByteMessage msg, Version version) {
             this.version = Version.UNDEFINED;
         }
 
-        this.host = msg.readString();
+        this.host = msg.readString(261);
         this.port = msg.readUnsignedShort();
         this.nextState = State.getById(msg.readVarInt());
     }

src/main/java/ua/nanit/limbo/protocol/packets/login/PacketLoginStart.java

@@ -33,7 +33,7 @@ public String getUsername() {
 
     @Override
     public void decode(ByteMessage msg, Version version) {
-        this.username = msg.readString();
+        this.username = msg.readString(16);
     }
 
     @Override