Reject negative data length in ExchangeCodec decode

dubbo-remoting/dubbo-remoting-api/src/main/java/org/apache/dubbo/remoting/exchange/codec/ExchangeCodec.java

@@ -118,6 +118,11 @@ protected Object decode(Channel channel, ChannelBuffer buffer, int readable, byt
         // get data length.
         int len = Bytes.bytes2int(header, 12);
 
+        // data length can not be negative, see https://github.com/apache/dubbo/issues/16447.
+        if (len < 0) {
+            throw new IOException("Data length can not be negative: " + len);
+        }
+
         // When receiving response, how to exceed the length, then directly construct a response to the client.
         // see more detail from https://github.com/apache/dubbo/issues/7021.
         Object obj = finishRespWhenOverPayload(channel, len, header);

dubbo-remoting/dubbo-remoting-api/src/test/java/org/apache/dubbo/remoting/codec/DeprecatedExchangeCodec.java

@@ -104,6 +104,12 @@ protected Object decode(Channel channel, InputStream is, int readable, byte[] he
 
         // get data length.
         int len = Bytes.bytes2int(header, 12);
+
+        // data length can not be negative, see https://github.com/apache/dubbo/issues/16447.
+        if (len < 0) {
+            throw new IOException("Data length can not be negative: " + len);
+        }
+
         checkPayload(channel, len);
 
         int tt = len + HEADER_LENGTH;

dubbo-remoting/dubbo-remoting-api/src/test/java/org/apache/dubbo/remoting/codec/ExchangeCodecTest.java

@@ -213,6 +213,20 @@ void test_Decode_Check_Payload() throws IOException {
         }
     }
 
+    @Test
+    void test_Decode_Negative_Data_Length() {
+        // magic dabb, flag c2, id all ff, data length ffffffff (-1)
+        byte[] request =
+                new byte[] {MAGIC_HIGH, MAGIC_LOW, (byte) 0xc2, 0, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1};
+
+        try {
+            decode(request);
+            Assertions.fail();
+        } catch (IOException expected) {
+            Assertions.assertTrue(expected.getMessage().contains("Data length can not be negative: -1"));
+        }
+    }
+
     @Test
     void test_Decode_Header_Need_Readmore() throws IOException {
         byte[] header = new byte[] {MAGIC_HIGH, MAGIC_LOW, 0, 0, 0, 0, 0, 0, 0, 0, 0};