GHSA-6r28-9ppf-4hj5: GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32(headerSize) without first ensuring avp.Length >= headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length < 8. An AVP with the Vendor flag set and a 24-bit Length field of 8, 9, 10, or 11 therefore underflows the uint32 subtraction to ~4,294,967,292, which is passed straight to make([]byte, dataLength). A single 32-byte Diameter message forces a ~4 GiB allocation; a short burst of such messages exhausts memory and OOM-kills memory-constrained collectors. This is an unauthenticated remote denial of service (CWE-191 integer underflow -> CWE-770 unbounded allocation). Root cause (file:line @ v1.6.0) layers/diameter_avp_decoders.go, decodeDiameterAVP: avp.Length = uint32(data[5])<<16 | uint32(data[6])<<8 | uint32(data[7]) // 24-bit wire value if avp.Length < 8 { // only rejects < 8 return DiameterAVP{}, 0, fmt.Errorf("invalid AVP length: %d", avp.Length) } headerSize := 8 dataOffset := 8 if avp.Flags.Vendor { // Vendor flag = wire bit data[4] & 0x80 if len(data) < 12 { ... } avp.VendorID = binary.BigEndian.Uint32(data[8:12]) headerSize = 12 // header is now 12, but only >= 8 was checked dataOffset = 12 } paddedLength := avp.Length // equals avp.Length; for avp.Length <= 12 if avp.Length%4 != 0 { paddedLength = avp.Length + (4 - avp.Length%4) } if uint32(len(data)) < paddedLength { // only requires ~12 bytes present return DiameterAVP{}, 0, fmt.Errorf("AVP data truncated: ...") } dataLength := avp.Length - uint32(headerSize) // 8 - 12 = uint32 underflow = 4294967292 avp.Data = make([]byte, dataLength) // make([]byte, ~4.29e9) ~= 4 GiB copy(avp.Data, data[dataOffset:dataOffset+int(dataLength)]) // out-of-bounds slice -> panic For avp.Length in {8, 9, 10, 11} with the Vendor flag set: the avp.Length < 8 guard passes, paddedLength == avp.Length so only avp.Length bytes must be present, and dataLength = a