Malformed packet with incorrect payload length in header caused exception

Packet++/src/IPReassembly.cpp

@@ -55,6 +55,7 @@ namespace pcpp
 
 		virtual uint8_t* getIPLayerPayload() = 0;
 		virtual size_t getIPLayerPayloadSize() = 0;
+		virtual size_t getIPLayerDataLen() = 0;
 
 		virtual ~IPFragmentWrapper()
 		{}
@@ -129,6 +130,11 @@ namespace pcpp
 			return m_IPLayer->getLayerPayloadSize();
 		}
 
+		size_t getIPLayerDataLen() override
+		{
+			return m_IPLayer->getDataLen();
+		}
+
 	private:
 		IPv4Layer* m_IPLayer;
 	};
@@ -214,6 +220,11 @@ namespace pcpp
 			return m_IPLayer->getLayerPayloadSize();
 		}
 
+		size_t getIPLayerDataLen() override
+		{
+			return m_IPLayer->getDataLen();
+		}
+
 	private:
 		IPv6Layer* m_IPLayer;
 		IPv6FragmentationHeader* m_FragHeader;
@@ -301,6 +312,12 @@ namespace pcpp
 			return fragment;
 		}
 
+		if (fragWrapper->getIPLayerPayloadSize() > fragWrapper->getIPLayerDataLen())
+		{
+			PCPP_LOG_DEBUG("Data length problem");
+			status = MALFORMED_FRAGMENT;
+			return fragment;
+		}
 		// create a hash from source IP, destination IP and IP/fragment ID
 		uint32_t hash = fragWrapper->hashPacket();
 

Tests/Pcap++Test/TestDefinition.h

@@ -93,6 +93,7 @@ PTF_TEST_CASE(TestIPFragMultipleFrags);
 PTF_TEST_CASE(TestIPFragMapOverflow);
 PTF_TEST_CASE(TestIPFragRemove);
 PTF_TEST_CASE(TestIPFragWithPadding);
+PTF_TEST_CASE(TestIPv4MalformedFragment);
 
 // Implemented in PfRingTests.cpp
 PTF_TEST_CASE(TestPfRingDevice);

Tests/Pcap++Test/Tests/IPFragmentationTests.cpp

@@ -1,6 +1,7 @@
 #include "../TestDefinition.h"
 #include "../Common/TestUtils.h"
 #include "IPReassembly.h"
+#include "IPv4Layer.h"
 #include "IPv6Layer.h"
 #include "HttpLayer.h"
 #include "PcapFileDevice.h"
@@ -1073,3 +1074,27 @@ PTF_TEST_CASE(TestIPFragWithPadding)
 	delete result;
 	delete[] buffer;
 }  // TestIPFragWithPadding
+
+PTF_TEST_CASE(TestIPv4MalformedFragment)
+{
+	std::vector<pcpp::RawPacket> packetStream;
+	std::string errMsg;
+
+	PTF_ASSERT_TRUE(readPcapIntoPacketVec("PcapExamples/ip4_bad_fragment.pcap", packetStream, errMsg));
+
+	pcpp::Packet frag1(&packetStream.at(0));
+
+	pcpp::IPv4Layer* ipLayer = frag1.getLayerOfType<pcpp::IPv4Layer>();
+	PTF_ASSERT_NOT_NULL(ipLayer);
+	PTF_ASSERT_TRUE(ipLayer->isFragment());
+	PTF_ASSERT_FALSE(ipLayer->isFirstFragment());
+	PTF_ASSERT_TRUE(ipLayer->isLastFragment());
+	PTF_ASSERT_NOT_EQUAL(ipLayer->getFragmentOffset(), 0);
+	PTF_ASSERT_EQUAL((ipLayer->getFragmentFlags() & PCPP_IP_MORE_FRAGMENTS), 0);
+
+	pcpp::IPReassembly::ReassemblyStatus status;
+	pcpp::IPReassembly reassembler;
+
+	reassembler.processPacket(&frag1, status);
+	PTF_ASSERT_EQUAL(status, pcpp::IPReassembly::MALFORMED_FRAGMENT);
+}  // TestIPv4MalformedFragment

Tests/Pcap++Test/main.cpp

@@ -177,7 +177,7 @@ int main(int argc, char* argv[])
 
 	if (PcapTestGlobalArgs.debugMode)
 	{
-		pcpp::Logger::getInstance().setAllModulesToLogLevel(pcpp::Logger::Debug);
+		pcpp::Logger::getInstance().setAllModulesToLogLevel(pcpp::LogLevel::Debug);
 	}
 
 	std::cout << "PcapPlusPlus version: " << pcpp::getPcapPlusPlusVersionFull() << std::endl
@@ -301,6 +301,7 @@ int main(int argc, char* argv[])
 	PTF_RUN_TEST(TestIPFragMapOverflow, "no_network;ip_frag");
 	PTF_RUN_TEST(TestIPFragRemove, "no_network;ip_frag");
 	PTF_RUN_TEST(TestIPFragWithPadding, "no_network;ip_frag");
+	PTF_RUN_TEST(TestIPv4MalformedFragment, "no_network;ip_frag");
 
 	PTF_RUN_TEST(TestRawSockets, "raw_sockets");