Repository navigation
nstun: add a bounds-checked reader for IP parsing - #366
Open
agusgarcia3007 wants to merge 1 commit into
Open
agusgarcia3007 wants to merge 1 commit into
agusgarcia3007 wants to merge 1 commit into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Move the IPv6 extension-header walk into ipparse.cc and use a small ByteReader for the IPv4 and IPv6 receive paths. The checks are the same, but the pointer and remaining length are now one object. Add tests for truncated extension headers, oversized lengths, fragments, and the chain depth limit.
agusgarcia3007
force-pushed
the
nstun-bounds-checked-reader
branch
from
October 19, 2026 21:55
84a2e1b to
1e6a830
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the first part of #309.
It adds a small
ByteReaderon top ofstd::spanand uses it in the IPv4and IPv6 receive paths. The IPv6 extension-header walk moves into
ipparse.ccso it can be tested on its own, without the rest of nstun.The set of accepted and rejected packets is the same as before. The checks
are unchanged, but the pointer and the remaining length are now one object
and cannot drift apart.
Tests:
makeon Debian bookworm with gcc 12 and-Wall -Wextra -Werrortests/nstun_ipparse_test(new)I will send the libFuzzer targets in a separate PR, as suggested in the
issue.