From 03af588ad5061cf7a41c504005a3ea371b3f84b2 Mon Sep 17 00:00:00 2001 From: Uwez Khan Date: Tue, 23 Jun 2026 22:22:51 +0530 Subject: [PATCH] tests: ipv6 hop-by-hop option length past option area Ticket: 8817 --- tests/decode-ipv6-hopopts-optlen/README.md | 19 +++++++++++++++++++ tests/decode-ipv6-hopopts-optlen/test.pcap | Bin 0 -> 102 bytes tests/decode-ipv6-hopopts-optlen/test.rules | 1 + tests/decode-ipv6-hopopts-optlen/test.yaml | 9 +++++++++ 4 files changed, 29 insertions(+) create mode 100644 tests/decode-ipv6-hopopts-optlen/README.md create mode 100644 tests/decode-ipv6-hopopts-optlen/test.pcap create mode 100644 tests/decode-ipv6-hopopts-optlen/test.rules create mode 100644 tests/decode-ipv6-hopopts-optlen/test.yaml diff --git a/tests/decode-ipv6-hopopts-optlen/README.md b/tests/decode-ipv6-hopopts-optlen/README.md new file mode 100644 index 0000000000..6c5c528a7d --- /dev/null +++ b/tests/decode-ipv6-hopopts-optlen/README.md @@ -0,0 +1,19 @@ +# Test Purpose + +Verify that an IPv6 hop-by-hop option whose length field runs one byte +past the option area is rejected as `decoder.ipv6.exthdr_invalid_optlen`. + +Before the per-option bounds check in `DecodeIPV6ExtHdrs` was corrected, +such an option was accepted and the Router Alert `memcpy` read one byte +past the option area. + +## PCAP + +Hand-crafted: IPv6 (payload len 8, next header hop-by-hop) carrying an +8 byte hop-by-hop header with three Pad1 options followed by a Router +Alert that declares 2 data bytes while only 1 fits in the 6 byte option +area. + +## Ticket + +https://redmine.openinfosecfoundation.org/issues/8817 diff --git a/tests/decode-ipv6-hopopts-optlen/test.pcap b/tests/decode-ipv6-hopopts-optlen/test.pcap new file mode 100644 index 0000000000000000000000000000000000000000..2c179329ab0fec1b06860d01f4de03269231f3fd GIT binary patch literal 102 zcmca|c+)~A1{MYcU}0bcaXtp8f+#yE2C*5Kz$9ba-2@PWgTdin1Bd~X;Q#mk-wa#E S{}2@rK?Vj!YY>Z-i2(rc2Mx^t literal 0 HcmV?d00001 diff --git a/tests/decode-ipv6-hopopts-optlen/test.rules b/tests/decode-ipv6-hopopts-optlen/test.rules new file mode 100644 index 0000000000..fdca982f0e --- /dev/null +++ b/tests/decode-ipv6-hopopts-optlen/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"IPv6 hop-by-hop option length runs past option area"; decode-event:ipv6.exthdr_invalid_optlen; sid:1;) diff --git a/tests/decode-ipv6-hopopts-optlen/test.yaml b/tests/decode-ipv6-hopopts-optlen/test.yaml new file mode 100644 index 0000000000..ae34d1111a --- /dev/null +++ b/tests/decode-ipv6-hopopts-optlen/test.yaml @@ -0,0 +1,9 @@ +requires: + min-version: 9 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1