Erm. Nevermind, just got fooled by a typo in the assert comment and syntax hilighting telling me the assert was still used. Anyway, typo fixed IP6_FRAG_COPYHEADER -> IPV6_FRAG_COPYHEADER.

Honestly, I don't want to fix this for windows and linux only. I've instead added a sanity check to ip6_reass_tmr(), so you don't actually need to receive a fragmented packet to trigger the assert. Any good compiler should optimize this check to nothing on 32-or-less-bit platforms.

Indeed, I failed to add that any usage of IP6_FRAG_COPYHEADER should be rewritten using if() { }.

If we want to keep MACRO, we can still use something like:

#define IPV6_FRAG_COPYHEADER   (defined(_x86_64_) && _x86_64_ || defined(_M_X64) && _M_X64)

Which should do the job at least for gcc and msvc.

What about adding the following in opt.h (instead of living in ip6_frag.h):

/** IP6_FRAG_COPYHEADER==1: When enabled, the IPv6 header is copied instead of

• referencing it. For platforms where sizeof(void*) > 4, this needs to be
• enabled (to not overwrite part of the data). It gives more room for
• struct ip6_reass_helper */

#ifndef IPV6_FRAG_COPYHEADER
#define IPV6_FRAG_COPYHEADER   (sizeof(void*) > 4)
#endif

This still should be fixed for 1.5.0

Attached is rewritten reassembly code.  The diff corresponds to tree state before 381a7b110a4a611e9956b2c644bc330bacb87073 ("fixed bug #41041 Potential use-after-free in IPv6 reassembly"), which is superceeded by this diff.  Typos fixed by the two commits after that are also already fixed in this diff.

(file #32451)

struct ip6_reass_helper "replaces the Fragment Header in memory in
incoming fragments".  Unfortunately, it contains struct pbuf
*next_pbuf pointer, so on 64-bit platforms that struct is larger than
struct ip6_frag_hdr and reassembly code overwrites the first 4 bytes
of each fragment.