Mike Jensen 408504af89 net/packet: fix Transport panic from a bad IPv4 IHL (#21331) ...

`decode4` assigned `q.subofs` before validating it against the declared IP total length. A packet with an IHL past the end of the buffer was rejected but left `subofs` dangling there, so a later Transport call would panic.

This change only store `subofs` once validated. As defense in depth an additional bounds check is added in Transport.

Fuzzing was expanded and improved to get better coverage in `packet.go`.

Credit to @Dev-next-gen for finding and reporting.

Fixes tailscale/corp#48322
Updates tailscale/corp#46608

Change-Id: I198d06b921add9b188daad79d4ca473aed1e3b66

Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-09-17 10:00:01 -06:00

..

oss-fuzz.sh

net/packet: fix Transport panic from a bad IPv4 IHL (#21331)

2026-09-17 10:00:01 -06:00