You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(reassembly): IPv4 reassembly raises IndexError for a fragment reaching octet 65,528 #1565
Describe the bug
IPv4 reassembly raises IndexError for any fragment whose data reaches octet 65,528. That includes a legal last fragment: Fragment Offset 8191 (65,528 octets) carrying 7 octets ends exactly at the 65,535 limit.
Reproduction
fromipaddressimportip_addressfrompcapkit.const.reg.transtypeimportTransTypefrompcapkit.foundation.reassembly.data.ipimportPacketfrompcapkit.foundation.reassembly.ipv4importIPv4bufid= (ip_address('192.0.2.1'), ip_address('198.51.100.2'), 7, TransType.UDP)
IPv4()(Packet(bufid, 1, 65528, 20, False, 27, b'H'*20, bytearray(b'A'*7), 1.0))
# IndexError: bytearray index out of range (pcapkit/foundation/reassembly/ip.py:258)
It fails the same way with MF set and in non-strict mode. A fragment at offset 65,520 with 8 octets does not crash. I reproduced this on main.
Expected behavior
No crash. The fragment is buffered, and the datagram completes or stays PARTIAL as usual.
System information
Linux, CPython 3.14.8, main at cf6e78a45.
Additional context
The data buffer is 65,535 octets, but the received-bit table RCVBT has only 8,191 blocks, which covers octets 0–65,527. _detect_conflicts then indexes rcvbt[pos // 8] with pos // 8 == 8191 (ip.py:258, reached via ip.py:167). The table needs 8,192 blocks. Found while reviewing #1564; that PR does not fix it.
Activity
JarryShaw commentedon Oct 10, 2026
The #1564 worker is fixing this in the same PR, because both changes are in
pcapkit/foundation/reassembly/ip.py.fix(reassembly): a TSO fragment's length is its captured length, and …
fix(reassembly): a TSO fragment's length is its captured length, and …
fix(reassembly): a datagram too long for its length field never compl…
fix(reassembly): a datagram too long for its length field never compl…