Validate uncompressed packet size

[jonesdevelopment]

In Minecraft, the client never sends a claimed uncompressed packet size of 0 if the actual size of the packet exceeds the compression threshold. In Velocity, there is no check to confirm that packets are the size they claim to be.

While this is not a huge vulnerability, it can be used to force Velocity to skip packets during compression, therefore potentially allowing people to send arbitrarily large packets.

For reference, this is the decompiled code of MCP for 1.19.2 and 1.21.4 (it's the same for all other version as well):

As you can see, the client uses the actual packet size to determine whether to compress the packet or not. Velocity simply relies on the claimedUncompressedSize, which can simply be set to 0 to skip the entire compression process.

Velocity/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftCompressDecoder.java

Lines 53 to 58 in c9aa1cc

	int claimedUncompressedSize = ProtocolUtils.readVarInt(in);
	if (claimedUncompressedSize == 0) {
	// This message is not compressed.
	out.add(in.retain());
	return;
	}