LoginPacket: fixed error handling edge case with malformed chain data JSON

src/network/mcpe/protocol/LoginPacket.php

@@ -33,7 +33,9 @@ use pocketmine\network\mcpe\protocol\types\login\JwtChain;
 use pocketmine\utils\BinaryDataException;
 use pocketmine\utils\BinaryStream;
 use function is_array;
+use function is_object;
 use function json_decode;
+use function json_last_error_msg;
 
 class LoginPacket extends DataPacket implements ServerboundPacket{
 	public const NETWORK_ID = ProtocolInfo::LOGIN_PACKET;
@@ -69,6 +71,9 @@ class LoginPacket extends DataPacket implements ServerboundPacket{
 		$buffer = new BinaryStream($in->getString());
 
 		$chainDataJson = json_decode($buffer->get($buffer->getLInt()));
+		if(!is_object($chainDataJson)){
+			throw new PacketDecodeException("Failed decoding chain data JSON: " . json_last_error_msg());
+		}
 		$mapper = new \JsonMapper;
 		$mapper->bExceptionOnMissingData = true;
 		$mapper->bExceptionOnUndefinedProperty = true;

tests/phpunit/network/mcpe/protocol/LoginPacketTest.php

@@ -0,0 +1,48 @@
+<?php
+
+/*
+ *
+ *  ____            _        _   __  __ _                  __  __ ____
+ * |  _ \ ___   ___| | _____| |_|  \/  (_)_ __   ___      |  \/  |  _ \
+ * | |_) / _ \ / __| |/ / _ \ __| |\/| | | '_ \ / _ \_____| |\/| | |_) |
+ * |  __/ (_) | (__|   <  __/ |_| |  | | | | | |  __/_____| |  | |  __/
+ * |_|   \___/ \___|_|\_\___|\__|_|  |_|_|_| |_|\___|     |_|  |_|_|
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * @author PocketMine Team
+ * @link http://www.pocketmine.net/
+ *
+ *
+*/
+
+declare(strict_types=1);
+
+namespace pocketmine\network\mcpe\protocol;
+
+use PHPUnit\Framework\TestCase;
+use pocketmine\network\mcpe\protocol\serializer\NetworkBinaryStream;
+use function strlen;
+
+class LoginPacketTest extends TestCase{
+
+	public function testInvalidChainDataJsonHandling() : void{
+		$stream = new NetworkBinaryStream();
+		$stream->putUnsignedVarInt(ProtocolInfo::LOGIN_PACKET);
+		$payload = '{"chain":[]'; //intentionally malformed
+		$stream->putInt(ProtocolInfo::CURRENT_PROTOCOL);
+
+		$stream2 = new NetworkBinaryStream();
+		$stream2->putLInt(strlen($payload));
+		$stream2->put($payload);
+		$stream->putString($stream2->getBuffer());
+
+		$pk = PacketPool::getInstance()->getPacket($stream->getBuffer());
+
+		$this->expectException(PacketDecodeException::class);
+		$pk->decode(); //bang
+	}
+}