Actions
Security #6675
closedip-defrag: packet can be considered complete even with holes
Git IDs:
d226d0a3fce8837936e1bdfaee496c80d417e0a5
Severity:
MODERATE
Disclosure Date:
Description
The test to check if all fragments exist is flawed. It adds up the data lengths, which can cause it to be larger than the data available in case of fragments.
To fix, the length of the re-assembled packet should only be incremented to the last byte of data seen.
This is covered by test peose/bsd/173
Actions