Fix CVE-2026-22590

This commit fixes CVE-2026-22590 by always checking the incoming data length in `CacheChange::add_fragments()`.

This is a squashed commit of a privately reviewed branch.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>
Reviewed-by: Ricardo González Moreno <ricardo@richiware.dev>

Author: MiguelCompany

include/fastdds/rtps/common/CacheChange.hpp

@@ -294,17 +294,16 @@ struct FASTDDS_EXPORTED_API CacheChange_t
             return false;
         }
 
-        // validate lengths
-        if (last_fragment_index < fragment_count_)
+        // Update incoming length for last fragment
+        if (last_fragment_index == fragment_count_)
         {
-            if (incoming_data.length < incoming_length)
-            {
-                return false;
-            }
+            incoming_length = serializedPayload.length - original_offset;
         }
-        else
+
+        // Validate lengths
+        if (incoming_data.length < incoming_length)
         {
-            incoming_length = serializedPayload.length - original_offset;
+            return false;
         }
 
         if (original_offset + incoming_length > serializedPayload.length)

test/blackbox/common/BlackboxTestsTransportUDP.cpp

@@ -989,6 +989,103 @@ TEST(TransportUDP, MaliciousDataFragUnalignedSizes)
     reader.block_for_all();
 }
 
+// Regression test for redmine issue #24030
+TEST(TransportUDP, MaliciousDataFragLastFragment)
+{
+    // Force using UDP transport
+    auto udp_transport = std::make_shared<UDPv4TransportDescriptor>();
+
+    PubSubWriter<UnboundedHelloWorldPubSubType> writer(TEST_TOPIC_NAME);
+    PubSubReader<UnboundedHelloWorldPubSubType> reader(TEST_TOPIC_NAME);
+
+    struct MaliciousDataFragInconsistentLastFragmentLength
+    {
+        std::array<char, 4> rtps_id{ {'R', 'T', 'P', 'S'} };
+        std::array<uint8_t, 2> protocol_version{ {2, 3} };
+        std::array<uint8_t, 2> vendor_id{ {0x01, 0x0F} };
+        GuidPrefix_t sender_prefix{};
+
+        struct DataFragSubMsg
+        {
+            struct Header
+            {
+                uint8_t submessage_id = 0x16;
+#if FASTDDS_IS_BIG_ENDIAN_TARGET
+                uint8_t flags = 0x00;
+#else
+                uint8_t flags = 0x01;
+#endif  // FASTDDS_IS_BIG_ENDIAN_TARGET
+                uint16_t octets_to_next_header = 0x24;
+                uint16_t extra_flags = 0;
+                uint16_t octets_to_inline_qos = 0x1c;
+                EntityId_t reader_id{};
+                EntityId_t writer_id{};
+                SequenceNumber_t sn{100};
+                uint32_t fragment_starting_num = 1;
+                uint16_t fragments_in_submessage = 8;
+                uint16_t fragment_size = 65504;
+                uint32_t sample_size = 65504 * 8;
+            };
+
+            struct SerializedData
+            {
+                octet data[4] {0xA0, 0xA1, 0xA2, 0xA3};
+            };
+
+            Header header;
+            SerializedData payload;
+        }
+        data;
+    };
+
+    UDPMessageSender fake_msg_sender;
+
+    // Set common QoS
+    reader.disable_builtin_transport().add_user_transport_to_pparams(udp_transport)
+            .history_depth(10).reliability(eprosima::fastdds::dds::RELIABLE_RELIABILITY_QOS);
+    writer.history_depth(10).reliability(eprosima::fastdds::dds::RELIABLE_RELIABILITY_QOS);
+
+    // Set custom reader locator so we can send malicious data to a known location
+    Locator_t reader_locator;
+    ASSERT_TRUE(IPLocator::setIPv4(reader_locator, "127.0.0.1"));
+    reader_locator.port = 7000;
+    reader.add_to_unicast_locator_list("127.0.0.1", 7000);
+
+    // Initialize and wait for discovery
+    reader.init();
+    ASSERT_TRUE(reader.isInitialized());
+    writer.init();
+    ASSERT_TRUE(writer.isInitialized());
+
+    reader.wait_discovery();
+    writer.wait_discovery();
+
+    auto data = default_unbounded_helloworld_data_generator();
+    reader.startReception(data);
+    writer.send(data);
+    ASSERT_TRUE(data.empty());
+
+    // Send malicious data
+    {
+        auto writer_guid = writer.datawriter_guid();
+
+        MaliciousDataFragInconsistentLastFragmentLength malicious_packet{};
+        malicious_packet.sender_prefix = writer_guid.guidPrefix;
+        malicious_packet.data.header.writer_id = writer_guid.entityId;
+        malicious_packet.data.header.reader_id = reader.datareader_guid().entityId;
+
+        CDRMessage_t msg(0);
+        uint32_t msg_len = static_cast<uint32_t>(sizeof(malicious_packet));
+        msg.init(reinterpret_cast<octet*>(&malicious_packet), msg_len);
+        msg.length = msg_len;
+        msg.pos = msg_len;
+        fake_msg_sender.send(msg, reader_locator);
+    }
+
+    // Block reader until reception finished or timeout.
+    reader.block_for_all();
+}
+
 // Regression test for redmine issue #23917
 TEST(TransportUDP, MaliciousHeartbeatBigStart)
 {