Fix underflow in parsePublishOk

Summary: Fixes underflow in `MoQFramerParser::parsePublishOk` for T251896132 and T251915198.

Reviewed By: afrind

Differential Revision: D91054063

fbshipit-source-id: f1552da3a6d7aea19ee39c258c54841c50f93da2

Author: Joanna Jo

moxygen/MoQFramer.cpp

@@ -2030,6 +2030,10 @@ folly::Expected<PublishOk, ErrorCode> MoQFrameParser::parsePublishOk(
   }
 
   if (getDraftMajorVersion(*version_) < 15) {
+    if (length < 1) {
+      XLOG(DBG4) << "parsePublishOk: UNDERFLOW on order";
+      return folly::makeUnexpected(ErrorCode::PARSE_UNDERFLOW);
+    }
     auto order = cursor.readBE<uint8_t>();
     length--;
     if (order > folly::to_underlying(GroupOrder::NewestFirst)) {

moxygen/test/MoQFramerTest.cpp

@@ -975,6 +975,26 @@ TEST(MoQFramerTest, ParseServerSetupNoOfParamsUnderflow) {
   EXPECT_EQ(result.error(), ErrorCode::PARSE_UNDERFLOW);
 }
 
+TEST(MoQFramerTest, ParsePublishOkOrderUnderflow) {
+  folly::IOBufQueue writeBuf{folly::IOBufQueue::cacheChainLength()};
+  size_t size = 0;
+  bool error = false;
+
+  writeVarint(writeBuf, 1, size, error); // requestID = 1
+  writeBuf.append("\x01", 1);            // forwardFlag = 1 (true)
+  writeBuf.append("\x80", 1);            // subscriberPriority = 128
+                                         // omit order byte to trigger underflow
+
+  auto buffer = writeBuf.move();
+  folly::io::Cursor cursor(buffer.get());
+
+  MoQFrameParser parser;
+  parser.initializeVersion(kVersionDraft14);
+  auto result = parser.parsePublishOk(cursor, buffer->computeChainDataLength());
+  EXPECT_TRUE(result.hasError());
+  EXPECT_EQ(result.error(), ErrorCode::PARSE_UNDERFLOW);
+}
+
 TEST_P(MoQFramerTest, All) {
   auto allMsgs = moxygen::test::writeAllMessages(writer_, GetParam());
   allMsgs->coalesce();