From cc36c1b5bf94cdeb0afb53a070fe30bafb2f5e59 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 9 Jan 2026 11:28:43 +0000
Subject: [PATCH] Improve error handling in packet reader - check error before
 processing

Only clear reserved bytes if read was successful (err == nil). This prevents
processing invalid data when conn.Read() returns an error.

Code review feedback addressed.

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>
---
 proxy/wireguard/bind.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/proxy/wireguard/bind.go b/proxy/wireguard/bind.go
index 53f028c7..cc443f73 100644
--- a/proxy/wireguard/bind.go
+++ b/proxy/wireguard/bind.go
@@ -183,7 +183,8 @@ func (bind *netBindClient) connectTo(endpoint *netEndpoint) error {
 			buf := make([]byte, maxPacketSize)
 			n, err := conn.Read(buf)
 			
-			if n > 3 {
+			// Only process data if we successfully read something
+			if err == nil && n > 3 {
 				// Clear reserved bytes
 				buf[1] = 0
 				buf[2] = 0