GHSA-g6v3-7xmc-w563: GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

Summary The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with make([]uint32, n) where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens *before* the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770). Root cause (file:line @ v1.6.0) Two sinks in layers/sflow.go, both in the ExtendedGatewayFlow (record type 1003) decode path: 1. layers/sflow.go:1306 in decodeExtendedGatewayFlowRecord: *data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) eg.Communities = make([]uint32, communitiesLength) // communitiesLength is a raw wire uint32, no bound for j := uint32(0); j < communitiesLength; j++ { ... } 2. layers/sflow.go:1276 in decodePath (a helper called from the same record decoder): *data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) ad.Members = make([]uint32, ad.Count) // ad.Count is a raw wire uint32, no bound for i := uint32(0); i < ad.Count; i++ { ... } In both cases the make is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked against the number of bytes actually remaining in the packet. communitiesLength = 0xFFFFFFFF requests make([]uint32, 4294967295) = 16,384 MB (16 GiB). Reachability (remote attacker -> sink) The registered LayerTypeSFlow decoder parses sFlow datagrams from the wire: SFlowDatagram.DecodeFromBytes (sflow.go:302) -> SampleCount loop -> decodeFlowSample(expanded=false) (sflow.go:458) -> RecordCount loop -> record format 1003 SFlowTypeExtendedGatewayFlow (sflow.go:573) -> decodeExtendedGatewayFlowRecord (sflow.go:1284) -> sink at line 1306 (and line 1276 via the AS