[PR #247] fix: bound aggregate junk spec size #259

New issue

Open

opened 2026-10-13 21:08:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:08:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/247
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/junk-spec-size-overflow

📝 Commits (1)

48f3599 fix: bound aggregate junk spec size

📊 Changes

1 file changed (+7 additions, -0 deletions)

View changed files

📝 src/junk.c (+7 -0)

📄 Description

Summary

Restore an upper bound on the aggregate I1-I5 CPS packet size and validate it before adding each tag length.

jp_spec_setup() currently sums tag->pkt_size values in a signed int and then uses the result for kzalloc(). Large positive <r>, <rc>, or <rd> lengths can therefore overflow the accumulator or request an oversized standalone junk packet.

Older versions of the module rejected CPS packets larger than MESSAGE_MAX_SIZE (65535 bytes). That guard disappeared during the AWG 3.x refactor.

This change restores the 65535-byte aggregate ceiling and checks each tag->pkt_size against the remaining space before addition, so the accumulator cannot overflow.

The aggregation check also rejects a negative tag length defensively. Parser-level rejection of negative lengths remains handled separately by #237.

Scope

This only changes CPS spec validation in jp_spec_setup(). Valid I1-I5 specs up to the historical 65535-byte limit are unchanged.

Related to #233

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/247 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/junk-spec-size-overflow` --- ### 📝 Commits (1) - [`48f3599`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/48f3599d3e56af59131fb9cce39fcfd799a0dfae) fix: bound aggregate junk spec size ### 📊 Changes **1 file changed** (+7 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/junk.c` (+7 -0) </details> ### 📄 Description ## Summary Restore an upper bound on the aggregate I1-I5 CPS packet size and validate it before adding each tag length. `jp_spec_setup()` currently sums `tag->pkt_size` values in a signed `int` and then uses the result for `kzalloc()`. Large positive `<r>`, `<rc>`, or `<rd>` lengths can therefore overflow the accumulator or request an oversized standalone junk packet. Older versions of the module rejected CPS packets larger than `MESSAGE_MAX_SIZE` (65535 bytes). That guard disappeared during the AWG 3.x refactor. This change restores the 65535-byte aggregate ceiling and checks each `tag->pkt_size` against the remaining space before addition, so the accumulator cannot overflow. The aggregation check also rejects a negative tag length defensively. Parser-level rejection of negative lengths remains handled separately by #237. ## Scope This only changes CPS spec validation in `jp_spec_setup()`. Valid I1-I5 specs up to the historical 65535-byte limit are unchanged. Related to #233 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:08:05 +00:00

bsakaguchi referenced this issue

2026-10-13 21:08:08 +00:00

[PR #265] compat: detect udp_tunnel sock/socket signatures instead of gating on kernel version (#259) #267