From b678a4f63b6f9397d1a0fa8f31e5b8e0271a4d00 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Fri, 3 Jul 2026 22:49:06 -0700
Subject: [PATCH] [lowpan] check datagramSize in Decompress and
 DecompressUdpHeader (#13276)

This commit adds robust bounds validation checks inside the lowpan
decompression routines to prevent potential integer underflows.

Specifically:
- In Lowpan::Decompress, we ensure that the declared datagramSize is
  large enough to contain the IPv6 header being decompressed at the
  current offset. This prevents underflow during recursive calls
  (e.g., for tunneled packets) when the datagram size is smaller
  than the combined headers.
- In Lowpan::DecompressUdpHeader, we verify that the remaining
  datagram length is sufficient to fit a UDP header, preventing
  underflow when calculating the UDP length from the offset.
---
 src/core/thread/lowpan.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/core/thread/lowpan.cpp b/src/core/thread/lowpan.cpp
index 390eeca02..7c58018df 100644
--- a/src/core/thread/lowpan.cpp
+++ b/src/core/thread/lowpan.cpp
@@ -970,6 +970,7 @@ Error Lowpan::DecompressUdpHeader(Message &aMessage, FrameData &aFrameData, uint
     }
     else
     {
+        VerifyOrExit(aDatagramLength >= aMessage.GetOffset() + sizeof(Ip6::UdpHeader), error = kErrorParse);
         udpHeader.SetLength(aDatagramLength - aMessage.GetOffset());
     }
 
@@ -1035,6 +1036,7 @@ Error Lowpan::Decompress(Message              &aMessage,
 
     if (aDatagramLength)
     {
+        VerifyOrExit(aDatagramLength >= currentOffset + sizeof(Ip6::Header), error = kErrorParse);
         ip6PayloadLength = BigEndian::HostSwap16(aDatagramLength - currentOffset - sizeof(Ip6::Header));
     }
     else