Possible Buffer Overflow

[JeremyRubin]

tokio-socks/src/tcp.rs

Line 337 in 9fdcccc

self.buf[(2 + username_len)] = password_len as u8;

if the username len is 256, and so is the password, then it seems our buf won't have enough space to write all the data and we'll possibly panic.

We should make the buffer larger, or return an err if username/password is too long.

another option would be to make the buf heap allocated and growable

[sticnarf]

validate_auth checks the length of the username and password. The buf size 513 is calculated according to the limitation.

[JeremyRubin]

you are totally correct!