From 49c0645fcbd708a1a55bacf7c36717c86d79075f Mon Sep 17 00:00:00 2001
From: Lonami Exo <totufals@hotmail.com>
Date: Sat, 2 Sep 2023 01:15:10 +0200
Subject: [PATCH] Fix full transport overreading

---
 client/src/telethon/_impl/mtproto/transport/full.py |  4 ++--
 client/tests/transport/abridged_test.py             |  9 +++++++++
 client/tests/transport/full_test.py                 | 11 +++++++++++
 client/tests/transport/intermediate_test.py         |  9 +++++++++
 4 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/client/src/telethon/_impl/mtproto/transport/full.py b/client/src/telethon/_impl/mtproto/transport/full.py
index fd59860f..4ded6f37 100644
--- a/client/src/telethon/_impl/mtproto/transport/full.py
+++ b/client/src/telethon/_impl/mtproto/transport/full.py
@@ -52,10 +52,10 @@ class Full(Transport):
             raise ValueError(f"bad seq, expected: {self._recv_seq}, got: {seq}")
 
         crc = struct.unpack_from("<I", input, length - 4)[0]
-        valid_crc = crc32(memoryview(input)[:-4])
+        valid_crc = crc32(memoryview(input)[: length - 4])
         if crc != valid_crc:
             raise ValueError(f"bad crc, expected: {valid_crc}, got: {crc}")
 
         self._recv_seq += 1
-        output += memoryview(input)[8:-4]
+        output += memoryview(input)[8 : length - 4]
         return length
diff --git a/client/tests/transport/abridged_test.py b/client/tests/transport/abridged_test.py
index 91a85e10..00e74bf7 100644
--- a/client/tests/transport/abridged_test.py
+++ b/client/tests/transport/abridged_test.py
@@ -59,6 +59,15 @@ def test_unpack_normal() -> None:
     assert input == unpacked
 
 
+def test_unpack_two_at_once() -> None:
+    transport, input, packed = setup_pack(128)
+    unpacked = bytearray()
+    transport.pack(input, packed)
+    n = transport.unpack(packed[1:] + packed[1:], unpacked)
+    assert input == unpacked
+    assert n == len(packed[1:])
+
+
 def unpack_large() -> None:
     transport, input, packed = setup_pack(1024)
     unpacked = bytearray()
diff --git a/client/tests/transport/full_test.py b/client/tests/transport/full_test.py
index a961b7ef..d2311e98 100644
--- a/client/tests/transport/full_test.py
+++ b/client/tests/transport/full_test.py
@@ -73,6 +73,17 @@ def test_unpack_normal() -> None:
     assert output == expected_output
 
 
+def test_unpack_two_at_once() -> None:
+    expected_output, transport, input, output = setup_unpack(128)
+    n = transport.unpack(input + input, output)
+    assert output == expected_output
+    assert n == len(input)
+    with raises(ValueError) as e:
+        transport.unpack(input, output)
+    e.match("bad seq")
+    assert output == expected_output
+
+
 def test_unpack_twice() -> None:
     transport, input, packed = setup_pack(128)
     unpacked = bytearray()
diff --git a/client/tests/transport/intermediate_test.py b/client/tests/transport/intermediate_test.py
index d35df085..3c5f4a08 100644
--- a/client/tests/transport/intermediate_test.py
+++ b/client/tests/transport/intermediate_test.py
@@ -50,3 +50,12 @@ def test_unpack_normal() -> None:
     transport.pack(input, packed)
     transport.unpack(packed[4:], unpacked)
     assert input == unpacked
+
+
+def test_unpack_two_at_once() -> None:
+    transport, input, packed = setup_pack(128)
+    unpacked = bytearray()
+    transport.pack(input, packed)
+    n = transport.unpack(packed[4:] + packed[4:], unpacked)
+    assert input == unpacked
+    assert n == len(packed[4:])