Project

General

Profile

Actions
Copy link

Bug #8661

closed
PA PA

sctp: unsigned overflow leads to buffer overflow

Bug #8661: sctp: unsigned overflow leads to buffer overflow

Added by Philippe Antoine about 2 months ago. Updated 10 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
9.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

We have uint8_t chunk_cnt = 0; but it can overflow and loop, resulting in tracked_chunk_cnt growing over SCTP_MAX_TRACKED_CHUNKS

Files

clusterfuzz-testcase-minimized-fuzz_decodepcapfile-4695003436482560 (52.6 KB) clusterfuzz-testcase-minimized-fuzz_decodepcapfile-4695003436482560 Philippe Antoine, 06/16/2026 09:46 AM

PA Updated by Philippe Antoine about 2 months ago Actions
Copy link
 #1

  • Status changed from New to In Review

Gitlab MR

JI Updated by Jason Ish about 2 months ago ยท Edited Actions
Copy link
 #3

  • Severity set to LOW

Does not apply to 8.0.x and 7.0.x, setting severity to LOW as not released and fixed publicly.

PA Updated by Philippe Antoine about 2 months ago Actions
Copy link
 #4

  • Status changed from In Review to Closed

VJ Updated by Victor Julien 10 days ago Actions
Copy link
 #5

  • Tracker changed from Security to Bug
  • Private changed from Yes to No
  • Severity deleted (LOW)

Since this was only in the main branch and not in any release this can be treated as a public bug.

Actions
Copy link

Also available in: PDF Atom