yamux/frame: Ensure frame io does not panic on invalid write results (#202)

* yamux/frame: Ensure frame io does not panic on invalid write results

Signed-off-by: Alexandru Vasile <[email protected]>

* frame/io: Apply clippy

Signed-off-by: Alexandru Vasile <[email protected]>

---------

Signed-off-by: Alexandru Vasile <[email protected]>
Co-authored-by: João Oliveira <[email protected]>

Author: lexnv

yamux/src/frame/io.rs

@@ -101,6 +101,14 @@ impl<T: AsyncRead + AsyncWrite + Unpin> Sink<Frame<()>> for Io<T> {
                             return Poll::Ready(Err(io::ErrorKind::WriteZero.into()));
                         }
                         *offset += n;
+
+                        if *offset > header.len() {
+                            return Poll::Ready(Err(io::Error::other(format!(
+                                "Writer header returned invalid write count n={n}: {offset} > {} ",
+                                header.len(),
+                            ))));
+                        }
+
                         if *offset == header.len() {
                             if !buffer.is_empty() {
                                 let buffer = std::mem::take(buffer);
@@ -122,6 +130,14 @@ impl<T: AsyncRead + AsyncWrite + Unpin> Sink<Frame<()>> for Io<T> {
                             return Poll::Ready(Err(io::ErrorKind::WriteZero.into()));
                         }
                         *offset += n;
+
+                        if *offset > buffer.len() {
+                            return Poll::Ready(Err(io::Error::other(format!(
+                                "Writer body returned invalid write count n={n}: {offset} > {} ",
+                                buffer.len(),
+                            ))));
+                        }
+
                         if *offset == buffer.len() {
                             this.write_state = WriteState::Init;
                         }