OISF · catenacyber · Jun 23, 2026
diff --git a/tests/decode-ipv6-hopopts-optlen/README.md b/tests/decode-ipv6-hopopts-optlen/README.md
@@ -0,0 +1,19 @@
+# Test Purpose
+
+Verify that an IPv6 hop-by-hop option whose length field runs one byte
+past the option area is rejected as `decoder.ipv6.exthdr_invalid_optlen`.
+
+Before the per-option bounds check in `DecodeIPV6ExtHdrs` was corrected,
+such an option was accepted and the Router Alert `memcpy` read one byte
+past the option area.
+
+## PCAP
+
+Hand-crafted: IPv6 (payload len 8, next header hop-by-hop) carrying an
+8 byte hop-by-hop header with three Pad1 options followed by a Router
+Alert that declares 2 data bytes while only 1 fits in the 6 byte option
+area.
+
+## Ticket
+
+https://redmine.openinfosecfoundation.org/issues/8817
diff --git a/tests/decode-ipv6-hopopts-optlen/test.pcap b/tests/decode-ipv6-hopopts-optlen/test.pcap
diff --git a/tests/decode-ipv6-hopopts-optlen/test.rules b/tests/decode-ipv6-hopopts-optlen/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"IPv6 hop-by-hop option length runs past option area"; decode-event:ipv6.exthdr_invalid_optlen; sid:1;)
diff --git a/tests/decode-ipv6-hopopts-optlen/test.yaml b/tests/decode-ipv6-hopopts-optlen/test.yaml
@@ -0,0 +1,9 @@
+requires:
+  min-version: 9
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert ip any any -> any any (msg:"IPv6 hop-by-hop option length runs past option area"; decode-event:ipv6.exthdr_invalid_optlen; sid:1;)