RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

## Summary A data integrity and protocol corruption vulnerability exists in the AMQP client's property serialization logic. When encoding AMQP short string (`shortstr`) fields—such as identifiers, routing strings, and content metadata—the length of the string is explicitly cast to a fixed-size 8-bit unsigned integer (`uint8`). If an application provides a property string exceeding 255 bytes, the length counter silently wraps around (e.g., a length of 300 wraps to 44). As a result, the parser writes only a truncated portion of the string into the outgoing connection buffer without returning an error. This leads to silent data corruption, broken RPC routing, and unpredictable broker-side state behavior. --- ## Vulnerability Details ### Mechanism The vulnerability resides in the wire-level serialization logic for application publishing properties: ```go // write.go:246 length := uint8(len(b)) // wraps silently when len(b) > 255 (e.g., 300 -> 44) ``` Because Go allows silent integer truncation during explicit type casting, lengths larger than $2^8 - 1$ lose their most significant bits. The underlying stream writer reads `length` to determine how many bytes to pull from the buffer. Because no error or boundary check accompanies this truncation, the application believes the full payload was transmitted successfully. ### Affected Properties This truncation behavior affects every standard AMQP field serialized as a `shortstr`: * `CorrelationId` * `ReplyTo` * `MessageId` * `Expiration