CVE-2024-45796

commit 9203656496c4081260817cce018a0d8fd57869b5
Author: Philippe Antoine <pantoine@oisf.net>
Date:   Mon Jul 15 09:52:00 2024 +0200

    defrag: fix off by one

    Ticket: 7067

    This off by one could lead to an empty fragment being inserted
    in the rb tree, which led to integer underflow

Gbp-Pq: Name CVE-2024-45796.patch

diff --git a/src/defrag.c b/src/defrag.c
index 0051eaa3170c366e3bd0e3100d77c321c3c8d877..ee68345b4f960bebba63a9120cc3ceb6e0a17d6d 100644 (file)
--- a/src/defrag.c
+++ b/src/defrag.c
@@ -818,7 +818,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
         }
     }
 
-    if (ltrim > data_len) {
+    if (ltrim >= data_len) {
         /* Full packet has been trimmed due to the overlap policy. Overlap
          * already set. */
         goto done;