fix and check bounds reading packets

[imsodin]

A lot of "slice bounds out of range" panics are occurring at https://github.com/ccding/go-stun/blob/master/stun/packet.go#L58

https://sentry.syncthing.net/share/issue/6d20d6707bfd4880a1ed8d1205f94d1d/
https://sentry.syncthing.net/share/issue/0c228b7490c84d82a7c6357bde37028c/

Two example bounds: [24:3] and [24:1]. Looks like the decoded uint16 length is overflowing when adding pos+4.

Looking at the code there's a few issues:

• The condition on the iteration is wrong: The ranges later on can exceed the packet length.
• The header length is 20 bytes, not sure where the 24 in code comes from?
• Converting the length to uint16 isn't ok, it might be max(uint16)+20 according to spec. I don't understand the need to do the iteration with uint16, but I kept it just in case - removing the header from the slice before taking the length.
• The overflow: Added a condition.

[codecov]

Codecov Report

Merging #40 (230614f) into master (3a7a6d9) will increase coverage by 0.34%.
The diff coverage is 57.14%.

@@            Coverage Diff             @@
##           master      #40      +/-   ##
==========================================
+ Coverage   22.18%   22.53%   +0.34%     
==========================================
  Files          11       11              
  Lines         320      324       +4     
==========================================
+ Hits           71       73       +2     
- Misses        244      245       +1     
- Partials        5        6       +1     

Impacted Files	Coverage Δ
stun/packet.go	64.28% <57.14%> (-1.10%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3a7a6d9...230614f. Read the comment docs.

[imsodin]

@ccding Can you please have a look at this?

[ccding]

LGTM

Thanks @imsodin

[imsodin]

Great, thanks for merging. Could you add a tag/make a release so we can ship this please?

[ccding]

@imsodin done