Harden scan robustness and tests

plugins/services/mssql_raw.go

@@ -23,6 +23,7 @@ const (
 
 	tdsVersion74        = 0x74000004
 	tdsDefaultPacketLen = 4096
+	maxTDSMessageSize   = 1024 * 1024
 
 	tdsPreloginVersion    = 0
 	tdsPreloginEncryption = 1
@@ -439,6 +440,9 @@ func mssqlReadMessage(r io.Reader) (byte, []byte, error) {
 		if _, err := io.ReadFull(r, chunk); err != nil {
 			return 0, nil, err
 		}
+		if len(payload)+len(chunk) > maxTDSMessageSize {
+			return 0, nil, fmt.Errorf("mssql: message too large")
+		}
 		payload = append(payload, chunk...)
 		if header[1]&tdsStatusEOM != 0 {
 			return packetType, payload, nil