From 064b6efc539a6a679c09ad0ef28ff1b48d52d18f Mon Sep 17 00:00:00 2001
From: sashaodessa <140454972+sashaodessa@users.noreply.github.com>
Date: Mon, 12 Jan 2026 12:26:48 +0100
Subject: [PATCH] Update message.go

---
 p2p/message.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/p2p/message.go b/p2p/message.go
index 3ab56ee350..7b7669619a 100644
--- a/p2p/message.go
+++ b/p2p/message.go
@@ -242,10 +242,18 @@ func ExpectMsg(r MsgReader, code uint64, content interface{}) error {
 	if int(msg.Size) != len(contentEnc) {
 		return fmt.Errorf("message size mismatch: got %d, want %d", msg.Size, len(contentEnc))
 	}
-	actualContent, err := io.ReadAll(msg.Payload)
+	// Read only up to the declared message size (+1 to detect overlong payloads).
+	limit := int64(msg.Size)
+	actualContent, err := io.ReadAll(io.LimitReader(msg.Payload, limit+1))
 	if err != nil {
 		return err
 	}
+	if int64(len(actualContent)) > limit {
+		return fmt.Errorf("message payload longer than declared size: got at least %d bytes, declared %d", len(actualContent), msg.Size)
+	}
+	if int64(len(actualContent)) < limit {
+		return fmt.Errorf("message payload shorter than declared size: got %d bytes, declared %d", len(actualContent), msg.Size)
+	}
 	if !bytes.Equal(actualContent, contentEnc) {
 		return fmt.Errorf("message payload mismatch:\ngot:  %x\nwant: %x", actualContent, contentEnc)
 	}