Addressed the Coverity-reported UDP dequeue issue by tightening the header/payload bounds checks, switching to a safe payload pointer, and rebuilding to ensure everything still compiles—here’s the rundown.

Actions taken
Guarded udp_rx_dequeue against truncated mbufs by comparing rte_pktmbuf_pkt_len(pkt) with sizeof(struct mt_udp_hdr) and bailing with EBADMSG if the headers aren’t fully present.
Recomputed the payload pointer via rte_pktmbuf_mtod_offset and validated the UDP payload length against both the UDP header value and the actual bytes available in the mbuf before any rte_memcpy, preventing the out-of-bounds read.
Logged richer diagnostics (using signed widths) and set errno when malformed packets are detected so callers receive a clear failure instead of silent drops.

Author: soopel

lib/src/udp/udp_main.c

@@ -913,10 +913,31 @@ static ssize_t udp_rx_dequeue(struct mudp_impl* s, void* buf, size_t len, int fl
   s->stat_pkt_dequeue++;
 
   struct mt_udp_hdr* hdr = rte_pktmbuf_mtod(pkt, struct mt_udp_hdr*);
+  const size_t hdr_len = sizeof(*hdr);
+  uint32_t pkt_len = rte_pktmbuf_pkt_len(pkt);
+
+  if (pkt_len < hdr_len) {
+    err("%s(%d), invalid packet len %u < header len %zu\n", __func__, idx, pkt_len,
+        hdr_len);
+    rte_pktmbuf_free(pkt);
+    errno = EBADMSG;
+    return -1;
+  }
+
   struct rte_udp_hdr* udp = &hdr->udp;
-  void* payload = &udp[1];
-  ssize_t payload_len = ntohs(udp->dgram_len) - sizeof(*udp);
-  dbg("%s(%d), payload_len %" PRIu64 " bytes\n", __func__, idx, payload_len);
+  ssize_t payload_len = (ssize_t)ntohs(udp->dgram_len) - sizeof(*udp);
+  ssize_t payload_cap = (ssize_t)pkt_len - hdr_len;
+
+  if (payload_len < 0 || payload_len > payload_cap) {
+    err("%s(%d), invalid payload len %" PRId64 " (cap %" PRId64 ")\n", __func__, idx,
+        (int64_t)payload_len, (int64_t)payload_cap);
+    rte_pktmbuf_free(pkt);
+    errno = EBADMSG;
+    return -1;
+  }
+
+  void* payload = rte_pktmbuf_mtod_offset(pkt, void*, hdr_len);
+  dbg("%s(%d), payload_len %" PRId64 " bytes\n", __func__, idx, (int64_t)payload_len);
 
   if (payload_len <= len) {
     rte_memcpy(buf, payload, payload_len);