[PR #237] fix: reject negative junk tag sizes #249

New issue

Open

opened 2026-10-13 21:07:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/237
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/reject-negative-junk-tag-sizes

📝 Commits (1)

73995f2 fix: reject negative junk tag sizes

📊 Changes

1 file changed (+3 additions, -3 deletions)

View changed files

📝 src/junk.c (+3 -3)

📄 Description

Summary

Reject negative size arguments in the CPS padding tags parsed by junk.c:

<r N>
<rc N>
<rd N>

kstrtoint() accepts negative values, and the parsed length was previously
stored in tag->pkt_size without validating its sign.

A negative modifier length can then participate in the aggregate packet-size
calculation and, when combined with another positive tag, leave a small positive
allocation while later copy/modifier operations still use the negative per-tag
size.

This change rejects negative lengths at parse time before a jp_tag is created.

Scope

This PR intentionally addresses only the negative-size parsing problem from #233.

It does not add a new upper bound for positive tag sizes or change aggregate
pkt_size overflow handling.

Fixes #233

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/237 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/reject-negative-junk-tag-sizes` --- ### 📝 Commits (1) - [`73995f2`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/73995f2b963fdb214106c4707be7a2fd3c1f654d) fix: reject negative junk tag sizes ### 📊 Changes **1 file changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/junk.c` (+3 -3) </details> ### 📄 Description ## Summary Reject negative size arguments in the CPS padding tags parsed by `junk.c`: - `<r N>` - `<rc N>` - `<rd N>` `kstrtoint()` accepts negative values, and the parsed length was previously stored in `tag->pkt_size` without validating its sign. A negative modifier length can then participate in the aggregate packet-size calculation and, when combined with another positive tag, leave a small positive allocation while later copy/modifier operations still use the negative per-tag size. This change rejects negative lengths at parse time before a `jp_tag` is created. ## Scope This PR intentionally addresses only the negative-size parsing problem from #233. It does not add a new upper bound for positive tag sizes or change aggregate `pkt_size` overflow handling. Fixes #233 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:07:59 +00:00

bsakaguchi referenced this issue

2026-10-13 21:08:05 +00:00

[PR #249] fix: preserve non-byte-aligned IPv6 bogus endpoint prefixes #262