fix(client): reject invalid negotiated packet length

crates/irtt-client/src/client/tests/negotiation.rs

@@ -28,3 +28,27 @@ fn loose_negotiation_accepts_server_restricted_params() {
     returned.length = 0;
     assert!(validate_negotiated_params(&requested, &returned, NegotiationPolicy::Loose).is_ok());
 }
+
+#[test]
+fn loose_negotiation_rejects_negative_returned_length() {
+    let config = ClientConfig::default();
+    let requested = params_from_config(&config).unwrap();
+    let mut returned = requested.clone();
+    returned.length = -1;
+    assert!(matches!(
+        validate_negotiated_params(&requested, &returned, NegotiationPolicy::Loose),
+        Err(ClientError::NegotiationRejected { reason }) if reason == "length must be non-negative"
+    ));
+}
+
+#[test]
+fn strict_negotiation_rejects_negative_returned_length() {
+    let config = ClientConfig::default();
+    let requested = params_from_config(&config).unwrap();
+    let mut returned = requested.clone();
+    returned.length = -1;
+    assert!(matches!(
+        validate_negotiated_params(&requested, &returned, NegotiationPolicy::Strict),
+        Err(ClientError::NegotiationRejected { reason }) if reason == "length must be non-negative"
+    ));
+}

crates/irtt-client/src/session.rs

@@ -48,6 +48,11 @@ pub(crate) fn validate_negotiated_params(
         });
     }
     validate_duration_restriction(requested.duration_ns, returned.duration_ns)?;
+    if returned.length < 0 {
+        return Err(ClientError::NegotiationRejected {
+            reason: "length must be non-negative".to_owned(),
+        });
+    }
     if returned.length > requested.length {
         return Err(ClientError::NegotiationRejected {
             reason: "length increased".to_owned(),