From 8f15190c230fe6975c9b18e31316c6bc494f3863 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=A3=8E=E6=89=87=E6=BB=91=E7=BF=94=E7=BF=BC?= Date: Sat, 11 Jul 2026 05:40:50 +0800 Subject: [PATCH] QUIC sniffer: Fix potential panic on malformed QUIC packets again (#6471) Fixes https://github.com/XTLS/Xray-core/security/advisories/GHSA-xqmr-94vq-cxvx Fixes https://github.com/XTLS/Xray-core/security/advisories/GHSA-9h6x-9r9m-5qw2 --- common/protocol/quic/sniff.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/common/protocol/quic/sniff.go b/common/protocol/quic/sniff.go index 0c20c3f61..eee3640f9 100644 --- a/common/protocol/quic/sniff.go +++ b/common/protocol/quic/sniff.go @@ -143,7 +143,9 @@ func SniffQUIC(b []byte) (*SniffHeader, error) { if err != nil { return nil, err } - + if len(b) < hdrLen+4+block.BlockSize() { + return nil, errNotQuic + } cache.Clear() mask := cache.Extend(int32(block.BlockSize())) block.Encrypt(mask, b[hdrLen+4:hdrLen+4+len(mask)])