Fixed fragment data size in IPv6 defragmentation

secdev · Jan 24, 2024 · 8798cef · 8798cef
1 parent d71014a
commit 8798cef
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/scapy/layers/inet6.py b/scapy/layers/inet6.py
@@ -1133,13 +1133,15 @@ def defragment6(packets):
 
     # regenerate the fragmentable part
     fragmentable = b""
+    frag_hdr_len = len(IPv6ExtHdrFragment)
     for p in res:
         q = p[IPv6ExtHdrFragment]
         offset = 8 * q.offset
         if offset != len(fragmentable):
             warning("Expected an offset of %d. Found %d. Padding with XXXX" % (len(fragmentable), offset))  # noqa: E501
+        frag_data_len = p[IPv6].plen - frag_hdr_len
         fragmentable += b"X" * (offset - len(fragmentable))
-        fragmentable += raw(q.payload)
+        fragmentable += raw(q.payload)[:frag_data_len]
 
     # Regenerate the unfragmentable part.
     q = res[0].copy()