[fralasp]

Fixes five issues reported by Forescout Research (Vedere Labs), disclosure FSCT-2026-0017/0018/0019/0020/0022. Five independent commits, one per issue, touching disjoint files.

FSCT-2026-0017 — Heap overflow in IP fragment reassembly (modules/pico_fragments.c)
pico_fragments_reassemble() allocates (uint16_t)(header_length + len), truncating the total mod 65536, while the copy loop writes the full length; the cumulative sum is never bounded. A crafted contiguous fragment chain exceeding 65535 bytes overflows the undersized heap buffer with attacker-controlled payload. Remote, pre-auth, with PICO_SUPPORT_IPV4FRAG/IPV6FRAG. Fix: reject totals that do not fit a 16-bit frame length, written as len > (65535 - header_length) so the test cannot itself wrap; the fragment tree is left to the existing expiration timer, as on the allocation-failure path below it.

FSCT-2026-0019 — Unsigned underflow in pico_udp_recv() → OOB read (modules/pico_udp.c)
The payload length is (uint16_t)(transport_len - 8) with no check that transport_len >= 8. A datagram claiming 0..7 transport bytes (checksum 0, valid per RFC 768) underflows to ~65528, driving a memcpy that reads far past the frame. Remote, pre-auth, default build. Fix: treat a transport length below the UDP header as a zero-length payload.

FSCT-2026-0022 — Off-by-option_len bound in pico_ipv4_process_in() → OOB read (modules/pico_ipv4.c)
max_allowed omits option_len, but the transport area starts option_len bytes further in, so the check admits a transport region up to 40 bytes past the frame; a downstream reader (e.g. the ICMP checksum) then reads out of bounds. Remote, pre-auth, single IPv4 packet with options. Fix: subtract option_len from the bound — the preceding net_len fit-check guarantees this cannot underflow.

FSCT-2026-0020 — Unbounded name walk in pico_dns_client_seek() → OOB read (modules/pico_dns_client.c)
The seek walks to a NUL terminator with no bound, on the raw response before header/ID validation, so a response with no terminator reads past the static dns_response buffer. Low practical severity (usually stops on zero-initialized .bss); reported for hardening. Fix: pass the end of the buffer explicitly and return NULL if no terminator is found — both call sites already handle NULL.

FSCT-2026-0018 — pico_socket_accept() address-buffer overflow (test/examples/tcpecho.c, include/pico_socket.h)
pico_socket_accept() sizes the peer-address copy by the socket family (16 bytes for IPv6) with no destination-size parameter, and the shipped tcpecho.c example passes a 4-byte struct pico_ip4 buffer regardless of family, a 12-byte overflow on an IPv6 build. Fix (non-breaking): use union pico_address in the example, as tcpbench.c already does, and document the buffer-size contract on the public declaration. A POSIX-style addrlen parameter would let the library bound the copy itself.

[danielinux]

Thanks a lot @fralasp for providing the patch upon public disclosure.

The fixes look good and it seems to fix the claim you reported.

One minor change requested for our CI gate:

The uncrustify job (0.78.1 on ubuntu 24.04) fails on modules/pico_dns_client.c:

FAIL: ./modules/pico_dns_client.c (File size changed from 24557 to 24556)

The formatter strips the blank line between the while loop and the comment in pico_dns_client_seek() (the comment attaches to the following if):

     while ((ptr < end) && (*ptr != 0))
         ptr++;
-
     /* No terminator within the response: reject instead of walking past it. */
     if (ptr >= end)
         return NULL;

Dropping that blank line makes the whole tree pass with the exact CI command
(find . -iname "*.[hc]" -type f -exec uncrustify --check -c uncrustify.cfg -l C {} +,
289 files, exit 0).

[fralasp]

@danielinux the issue should be fixed now