[PR #235] fix: guard invalid junk packet size range #248

New issue

Open

opened 2026-10-13 21:07:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/235
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/jmin-jmax-range-validation

📝 Commits (1)

8c3dec8 fix: guard invalid junk packet size range

📊 Changes

1 file changed (+10 additions, -5 deletions)

View changed files

📝 src/send.c (+10 -5)

📄 Description

Summary

Snapshot Jc, Jmin and Jmax before generating dummy junk packets and use
those values consistently for both the allocation size and the random packet
size range.

If an invalid Jmin > Jmax pair is observed, clamp Jmin to Jmax before
calling get_random_u32_inclusive().

This prevents an invalid or transiently inconsistent range from underflowing
inside the random range calculation and producing a packet size larger than
the Jmax-sized buffer.

Using a single snapshot also avoids mixing old and new Jmin / Jmax values
if the device configuration is updated while a handshake worker is running.

Scope

This PR addresses only the Jmin > Jmax / inconsistent-range part of #225.

The unchecked kzalloc() result reported in the same issue is intentionally
left for a separate change.

Related to #225

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/235 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/jmin-jmax-range-validation` --- ### 📝 Commits (1) - [`8c3dec8`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/8c3dec88145d1a3e77bc2316cfb78f72c92e2c91) fix: guard invalid junk packet size range ### 📊 Changes **1 file changed** (+10 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `src/send.c` (+10 -5) </details> ### 📄 Description ## Summary Snapshot `Jc`, `Jmin` and `Jmax` before generating dummy junk packets and use those values consistently for both the allocation size and the random packet size range. If an invalid `Jmin > Jmax` pair is observed, clamp `Jmin` to `Jmax` before calling `get_random_u32_inclusive()`. This prevents an invalid or transiently inconsistent range from underflowing inside the random range calculation and producing a packet size larger than the `Jmax`-sized buffer. Using a single snapshot also avoids mixing old and new `Jmin` / `Jmax` values if the device configuration is updated while a handshake worker is running. ## Scope This PR addresses only the `Jmin > Jmax` / inconsistent-range part of #225. The unchecked `kzalloc()` result reported in the same issue is intentionally left for a separate change. Related to #225 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:07:58 +00:00

bsakaguchi referenced this issue

2026-10-13 21:08:05 +00:00

[PR #248] fix: avoid undefined shift for /0 bogus endpoint prefixes #260