## Summary When the BPv6 fragmenter fails to duplicate a block during fragmentation, its cleanup writes the block-list head through a cursor that has already advanced past it, linking the payload list node back into the list and forming a cycle. `bundle_free` then walks the cycle and frees the same node twice, a use-after-free and double free in `components/bundle6/fragment.c`. The corruption terminates the µD3TN process with a segmentation fault.Fragmentation is requested by an AAP 2.0 dispatcher, or performed by the daemon itself when a bundle exceeds the configured maximum bundle size or contact capacity, and the defect additionally requires an allocation to fail during fragmentation. ## Details `bundle6_fragment_bundle` copies each block of the source bundle into the new fragment, tracking the insertion point with a cursor that advances on every iteration: ```c struct bundle_block_list **block_entry = &fragment->blocks; struct bundle_block_list *const payload_blist = fragment->blocks; ... *block_entry = entry; block_entry = &entry->next; ``` When a block must be replicated into the fragment, it is duplicated. On duplication failure the cleanup tries to restore the payload entry and free the fragment: ```c entry = bundle_block_entry_dup(cur_block); if (entry == NULL) { *block_entry = payload_blist; bundle_free(fragment); return NULL; } ``` `*block_entry = payload_blist` is correct only while the payload entry has not yet been inserted. Once it has been inserted, `block_entry` points at the `next` field of the last inserted entry, so the assigmnent links the list back to `payload_blist` and forms a cycle (a self-loop when the payload entry is the last one inserted). `bundle_free` reaches `bundle_free_dynamic_parts`, which walks the list with `bundle_block_entry_free`: ```c next = e->next; bundle_block_free(e->data); free(e); return next; ``` Following the cycle, `bundle_block_entry_free` reads `e->next` from the node it has just freed and frees the same node a second time Reaching the failing duplication requires a BPv6 bundle whose payload block is followed by a block that is replicated into the fragment (a block flagged `MUST_BE_REPLICATED`, or any non-payload block after the payload on the last fragment), together with an allocation failure inside `bundle_block_entry_dup`. The fragmenter is reached when an AAP 2.0 dispacther returns a fragment length below the payload length, or when the bundle processor fragments a bundle to fit the maximum bundle size (`-m`, or the limit of an outgoing CLA) or, with the built-in router, a contact capacity. ## Proof of concept The following BPv6 bundle triggers the defect when it is fragmented and an allocation fails during that fragmentation: ``` 06 81 10 4e 00 04 13 17 2a 2e 33 37 83 92 ad c9 64 00 85 a3 00 3c 64 74 6e 00 2f 2f 74 61 72 67 65 74 2e 64 74 6e 2f 78 00 64 74 6e 00 2f 2f 61 74 74 61 63 6b 65 72 2e 64 74 6e 2f 61 70 70 00 64 74 6e 00 6e 6f 6e 65 00 64 74 6e 00 6e 6f 6e 65 00 01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 09 08 00 00 00 00 00 00 00 00 ``` The bundle carries a 16-byte payload block (`01 00 10`) followed by an extension block of type 7 (`07 09 08`) whose flag byte `0x09` sets `MUST_BE_REPLICATED` and `LAST_BLOCK`. Because that extension block is replicated and sits after the payload, the fragmenter duplicates it once the payload entry is already linked, so the failed-duplication cleanup links the payload node to itself. Two preconditions: the bundle must be fragmented, either by an AAP 2.0 dispatcher returning a fragmentation request with a non-zero fragment length below the payload length, or by the daemon itself because the bundle exceeds the maximum bundle size. Additionally, an allocation must fail inside `bundle_block_entry_dup` while the extension block is duplicated. The bundle carries a creation timestamp (`83 92 ad c9 64`) and is dropped once its lifetime has elapsed, so the timestamp must be refreshed before replay. Under AddressSanitizer this reports a heap-use-after-free in `bundle_block_entry_free` as `bundle_free` walks the cyclic list. Without a sanitizer it is a segmentation fault in `bundle_block_free`. ## Impact An allocation failure during fragmentation corrupts the heap and terminates the µD3TN process, stopping all bundle forwarding on the node. The bundle can be fragmented through the AAP 2.0 control interface, or by a bundle from a network peer on a node that fragments by maximum bundle size or contact capacity. The defect additionally requires an allocation failure during fragmentation. ## Remediation The cleanup should re-link the payload entry only when it has not already been inserted into the fragment. The function already tracks this with `payload_found`, which is false until the payload block is inserted. ```c if (entry == NULL) { if (!payload_found) *block_entry = payload_blist; /* still unlinked: reattach it */ else *block_entry = NULL; /* already linked: terminate the list */ bundle_free(fragment); return NULL; } ``` While the payload entry is still unlinked, reattaching it lets `bundle_free` reclaim it. Once it is linked, terminating the list with `NULL` frees every block once and leaves no cycle.