[PR #191] fix: reject jmin > jmax instead of underflowing the junk packet size #195

New issue

Open

opened 2026-10-13 21:04:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:04:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-go/pull/191
Author: @artromone
Created: 9/3/2026
Status: 🔄 Open

Base: master ← Head: fix/junk-size-range-validation

📝 Commits (1)

91a10f3 fix: reject jmin > jmax instead of underflowing the junk packet size

📊 Changes

2 files changed (+90 additions, -6 deletions)

View changed files

📝 device/uapi.go (+25 -6)
➕ device/uapi_test.go (+65 -0)

📄 Description

jc/jmin/jmax were written straight to the device as each UAPI line was parsed, so jmin was never checked against jmax. Both values are individually legal, so the pair was accepted. JunkPackets() then does:

buf := make([]byte, min+fastrandn(max-min))

With min > max, max-min underflows uint32 and the daemon tries a multi-gigabyte allocation per junk packet.

Stage the junk sizes in ipcSetDevice like the h/s fields, and validate ordering in mergeWithDevice alongside the header overlap and header-protection padding checks. Staging keeps a request that raises both bounds at once (jmin=500 jmax=1000 over a stored jmax=100) working, which a per-line check would reject, and leaves the device untouched when a request is refused.

jmin == jmax stays legal: fastrandn(0) is 0, so every junk packet is exactly jmin bytes.

Refs #189

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-go/pull/191 **Author:** [@artromone](https://github.com/artromone) **Created:** 9/3/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/junk-size-range-validation` --- ### 📝 Commits (1) - [`91a10f3`](https://github.com/amnezia-vpn/amneziawg-go/commit/91a10f31c5aa873e2547d0aa80ee24d9793c6f13) fix: reject jmin > jmax instead of underflowing the junk packet size ### 📊 Changes **2 files changed** (+90 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `device/uapi.go` (+25 -6) ➕ `device/uapi_test.go` (+65 -0) </details> ### 📄 Description jc/jmin/jmax were written straight to the device as each UAPI line was parsed, so jmin was never checked against jmax. Both values are individually legal, so the pair was accepted. JunkPackets() then does: buf := make([]byte, min+fastrandn(max-min)) With min > max, max-min underflows uint32 and the daemon tries a multi-gigabyte allocation per junk packet. Stage the junk sizes in ipcSetDevice like the h/s fields, and validate ordering in mergeWithDevice alongside the header overlap and header-protection padding checks. Staging keeps a request that raises both bounds at once (jmin=500 jmax=1000 over a stored jmax=100) working, which a per-line check would reject, and leaves the device untouched when a request is refused. jmin == jmax stays legal: fastrandn(0) is 0, so every junk packet is exactly jmin bytes. Refs #189 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:04:28 +00:00

bsakaguchi referenced this issue

2026-10-13 21:04:32 +00:00

[PR #203] test: skip directories ignored by the go command in TestFormatting #202