add validation of compact binary payloads before reading them (#483)

* add validation of compact binary payloads before reading them

1 files changed, 10 insertions, 1 deletions

diff --git a/src/zenutil/jupiter/jupitersession.cpp b/src/zenutil/jupiter/jupitersession.cpp
index 1fd59acdf..c305dc477 100644
--- a/src/zenutil/jupiter/jupitersession.cpp
+++ b/src/zenutil/jupiter/jupitersession.cpp
@@ -4,6 +4,7 @@
 
 #include <zencore/compactbinary.h>
 #include <zencore/compactbinarybuilder.h>
+#include <zencore/compactbinaryutil.h>
 #include <zencore/compositebuffer.h>
 #include <zencore/compress.h>
 #include <zencore/fmtutils.h>
@@ -526,7 +527,15 @@ JupiterSession::PutMultipartBuildBlob(std::string_view												  Namespace,
 		ZEN_WARN("{}", StartMultipartResponse.ErrorMessage("startMultipartUpload: "));
 		return detail::ConvertResponse(StartMultipartResponse, "JupiterSession::PutMultipartBuildBlob"sv);
 	}
-	CbObject ResponseObject = LoadCompactBinaryObject(StartMultipartResponse.ResponsePayload);
+	CbValidateError ValidateResult = CbValidateError::None;
+	CbObject		ResponseObject = ValidateAndReadCompactBinaryObject(IoBuffer(StartMultipartResponse.ResponsePayload), ValidateResult);
+	if (ValidateResult != CbValidateError::None)
+	{
+		JupiterResult Result = detail::ConvertResponse(StartMultipartResponse, "JupiterSession::PutMultipartBuildBlob"sv);
+		Result.ErrorCode	 = (int32)HttpResponseCode::UnsupportedMediaType;
+		Result.Reason		 = fmt::format("Invalid multipart response object format: '{}'", ToString(ValidateResult));
+		return Result;
+	}
 
 	struct WorkloadData
 	{