From: John Thacker Date: Mon, 12 Jan 2026 15:28:22 +0000 Subject: QUIC: Update reassembly ID for a new MSP When a QUIC frame has more than one MSP, the reassembly id for the second MSP has to be used when adding or looking it up, instead of the original reassembly id of the first MSP. Fixes reassembly of the file in #20944 in most cases, outside of issues with out of order UDP packets / QUIC packets. (cherry picked from commit 562c3c070c6f58d01904d42338489b1a64ad7655) Co-authored-by: John Thacker origin: https://gitlab.com/wireshark/wireshark/-/merge_requests/23175 CVE: CVE-2026-0960 Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/f31123dcdbac37272046b58b2f7941bc7fb42934] Signed-off-by: Hitendra Prajapati --- epan/dissectors/packet-quic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/epan/dissectors/packet-quic.c b/epan/dissectors/packet-quic.c index cabc2c5..7614b7f 100644 --- a/epan/dissectors/packet-quic.c +++ b/epan/dissectors/packet-quic.c @@ -1781,9 +1781,10 @@ again: deseg_seq, nxtseq+pinfo->desegment_len, stream->multisegment_pdus); } - /* add this segment as the first one for this new pdu */ + /* add this segment as the first one for this new pdu + * Use the the new MSP's reassembly ID (its first frame). */ fragment_add(&quic_reassembly_table, tvb, deseg_offset, - pinfo, reassembly_id, NULL, + pinfo, msp->first_frame, stream_info, 0, nxtseq - deseg_seq, nxtseq < msp->nxtpdu); } -- 2.50.1