yujunjun/v2ray-core
1
0
Fork 0
mirror of https://github.com/v2fly/v2ray-core.git synced 2025-06-26 21:29:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

QUIC sniffer: Fix potential slice panic (#3406)

Browse Source 
* QUIC sniffer: Fix potential slice panic

* Fix type err

* Update sniff.go

* Add test and fix more

* Refine
This commit is contained in:
风扇滑翔翼 2025-05-18 03:53:29 +08:00 committed by GitHub
parent 28f558601f
commit 1f2d76c066
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
common/protocol/quic/sniff.go
View File

@ -116,6 +116,10 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
if err != nil { if err != nil {
return nil, errNotQuic return nil, errNotQuic
} }
// packet is impossible to shorter than this
if packetLen < 4 {
return nil, errNotQuic
}
hdrLen := len(b) - int(buffer.Len()) hdrLen := len(b) - int(buffer.Len())
if len(b) < hdrLen+int(packetLen) { if len(b) < hdrLen+int(packetLen) {

18
common/protocol/quic/sniff_test.go
View File

@ -239,3 +239,21 @@ func TestSniffQUICComplex(t *testing.T) {
}) })
} }
} }
func TestSniffFakeQUICPacketWithInvalidPacketNumberLength(t *testing.T) {
pkt, err := hex.DecodeString("cb00000001081c8c6d5aeb53d54400000090709b8600000000000000000000000000000000")
common.Must(err)
_, err = quic.SniffQUIC(pkt)
if err == nil {
t.Error("failed")
}
}
func TestSniffFakeQUICPacketWithTooShortData(t *testing.T) {
pkt, err := hex.DecodeString("cb00000001081c8c6d5aeb53d54400000090709b86")
common.Must(err)
_, err = quic.SniffQUIC(pkt)
if err == nil {
t.Error("failed")
}
}