From d62b7cd98054ab03156e7ce2cac15166b46ab391 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Wed, 6 May 2026 16:13:35 -0600
Subject: [PATCH] dnp3: bound response reassembly

Ticket: 8460
(cherry picked from commit 078c08d84b8fadea59caf66e304cdc52789c132e)
---
 src/app-layer-dnp3.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index ae4303ea07..137310ddea 100644
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -1026,6 +1026,13 @@ static void DNP3HandleUserDataResponse(
         DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_MALFORMED);
         return;
     }
+    // a data link frame has its size on one byte,
+    // and transport layer has sequence in 0-63
+    if (tx->buffer_len > 63 * 0xff) {
+        DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_TOO_LONG_REASS);
+        tx->done = 1;
+        return;
+    }
 
     if (!DNP3_TH_FIN(th)) {
         return;