Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2

[Solar Designer <solar () openwall com>]

On Wed, Apr 29, 2026 at 01:48:07AM +0300, Dmitry Butskoy wrote:
> From the appearing of this fragment of code in 2.0.12 (2008 year), the 
> statement "n -= hlen;" is present here. Including the current version of 
> 2.1.6, see line 1423 of traceroute/traceroute.c :
>
> >         if (!err &&
> >             af == AF_INET &&
> >             /*  XXX: Assume that the presence of an extra 
> > header means
> >                 that it is not a raw socket...
> >             */
> >             ops->header_len == 0
> >         ) {
> >             struct iphdr *ip = (struct iphdr *) bufp;
> >             int hlen;
> >
> >             if (n < sizeof (struct iphdr))  return;
> >
> >             hlen = ip->ihl << 2;
> >             if (n < hlen)  return;
> >
> >             bufp += hlen;
> >             n -= hlen;
> >         }

Thank you, Dmitry!

> What source did you use? Why is your report for version 2.1.2 when the 
> latest version is 2.1.6?
>
> Note again, that the version of 2.1.2 has this statement as well.
>
> Could you please find out where you got this inherently corrupted code 
> based on an old version?

FWIW, I've just checked that traceroute-2.1.1-1.el9.src.rpm also
contains the "n -= hlen;" line where Mohamed proposes to add it.

We do indeed need to hear from Mohamed on where he or his AI saw or
hallucinated this, but for now I think it's safe to assume this whole
report is an AI slop.

Mohamed - going forward, please carefully review AI-generated content
before spending other people's time on it, and please always disclose
your use of AI (ideally, including the specifics) and why you think the
content is worthwhile anyway.

Alexander