Skip to content

Fix connected explicit length underflow handling#585

Open
MrAlaskan wants to merge 1 commit into
EIPStackGroup:masterfrom
MrAlaskan:fix/connected-negative-length-underflow
Open

Fix connected explicit length underflow handling#585
MrAlaskan wants to merge 1 commit into
EIPStackGroup:masterfrom
MrAlaskan:fix/connected-negative-length-underflow

Conversation

@MrAlaskan

Copy link
Copy Markdown

Vulnerability Description

This change fixes an integer underflow issue in the connected explicit message handling path (see #568).

Fix Description

The fix adds an explicit minimum-length check in source/src/enet_encap/cpf.c before the sequence number is decoded.

For connected explicit packets:

  • if data_item.length < 2, the packet is rejected immediately
  • an error trace is emitted to make the reason visible during debugging
  • no sequence number is read from an undersized payload
  • malformed connected explicit requests are stopped at the CPF handling boundary

This keeps the fix localized to the actual faulting entry point and prevents malformed connected explicit packets from progressing further into the request processing path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant