From 5ba6d3c4eb25a5140736cfd2bcc3e7937cc6132b Mon Sep 17 00:00:00 2001
From: gaohedong <gaohedong@xiaomi.com>
Date: Sat, 27 Dec 2025 13:51:26 +0800
Subject: [PATCH] net/udp: Validate UDP length field against actual packet size

According to RFC768 page 2, length feild is the length  in octets  of this user datagram  including  this header  and the data.

Signed-off-by: gaohedong <gaohedong@xiaomi.com>
---
 net/udp/udp_input.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/udp/udp_input.c b/net/udp/udp_input.c
index 3ff17462a33..f6fd0b1fc7c 100644
--- a/net/udp/udp_input.c
+++ b/net/udp/udp_input.c
@@ -215,6 +215,7 @@ static int udp_input(FAR struct net_driver_s *dev, unsigned int iplen)
   FAR struct iob_s *iob;
 #endif
   unsigned int udpiplen;
+  unsigned int udpdatalen = dev->d_len - iplen;
 #ifdef CONFIG_NET_UDP_CHECKSUMS
   uint16_t chksum;
 #endif
@@ -232,6 +233,16 @@ static int udp_input(FAR struct net_driver_s *dev, unsigned int iplen)
 
   udp = IPBUF(iplen);
 
+  /* Check the UDP packet length */
+
+  if (udpdatalen < UDP_HDRLEN || ntohs(udp->udplen) != udpdatalen)
+    {
+      nwarn("WARNING: UDP length invalid: hdr=%u actual=%u\n",
+            ntohs(udp->udplen), udpdatalen);
+      dev->d_len = 0;
+      return ret;
+    }
+
   /* Get the size of the IP header and the UDP header */
 
   udpiplen = iplen + UDP_HDRLEN;