From 94bb748e531057a2e3da925c9c7cde744b0384e5 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Tue, 11 Aug 2026 11:20:58 -0600 Subject: [PATCH] defrag/ipv6: reject oversized reassembled payloads Fragmented IPv6 packets with an unfragmentable extension header can exceed the maximum allowed size. Use a u32 to check the size to prevent wrap-around, rejecting the packet and setting an event if too large. Ticket: #8818. --- src/defrag.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/defrag.c b/src/defrag.c index 397041aa3f..0d159eee74 100644 --- a/src/defrag.c +++ b/src/defrag.c @@ -490,17 +490,21 @@ Defrag6Reassemble(ThreadVars *tv, DefragTracker *tracker, Packet *p) prev_offset = frag->offset; } + const uint32_t payload_len = (uint32_t)unfragmentable_len + fragmentable_len; + if (payload_len > IPV6_MAXPACKET) { + ENGINE_SET_EVENT(p, IPV6_FRAG_PKT_TOO_LARGE); + goto error_remove_tracker; + } + IPV6Hdr *ip6h = (IPV6Hdr *)(GET_PKT_DATA(rp) + tracker->ip_hdr_offset); - DEBUG_VALIDATE_BUG_ON(unfragmentable_len > UINT16_MAX - fragmentable_len); - ip6h->s_ip6_plen = htons(fragmentable_len + unfragmentable_len); + ip6h->s_ip6_plen = htons((uint16_t)payload_len); /* if we have no unfragmentable part, so no ext hdrs before the frag * header, we need to update the ipv6 headers next header field. This * points to the frag header, and we will make it point to the layer * directly after the frag header. */ if (unfragmentable_len == 0) ip6h->s_ip6_nxt = next_hdr; - SET_PKT_LEN(rp, ip_hdr_offset + sizeof(IPV6Hdr) + - unfragmentable_len + fragmentable_len); + SET_PKT_LEN(rp, ip_hdr_offset + sizeof(IPV6Hdr) + payload_len); tracker->remove = 1; DefragTrackerFreeFrags(tracker);