mirror of
https://github.com/slackhq/nebula.git
synced 2026-08-15 18:17:02 +02:00
921ed4360a
The length checks were fishy on four counts: an empty hdr/transportHdr with real payload returned nil (silent drop with a success signal); the HdrLen/GSOSize/CsumStart uint16 conversions could wrap unchecked; nothing verified transportHdr covers csum_start+csum_offset, so the kernel's NEEDS_CSUM write could land in payload bytes; and there was no total-size bound even though every length field involved is 16-bit. Malformed geometry is now a real error, and a single 65535 total-length guard makes all the u16 conversions exact. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>