Fix several CVEs

* Fix [CVE-2025-63829] by avoiding the infinite loop in `Time_t::fraction()`, and checking for consistency in the nanosecond values of QoS.
* Fix [CVE-2025-65865] by checking values before substraction in `proc_Submsg_DataFrag`.
* Fix [CVE-2026-45093] with a refactor of `RTCPMessageManager`.
* Fix [CVE-2026-45092] by applying limits to the size of `SecurityManager::discovered_participants_`.
* Fix [CVE-2026-45097] by checking bounds when deserializing sequences in `DynamicDataImpl`.

This is a squashed commit of a privately reviewed branch.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>
Signed-off-by: Zakaria Talbi Lalmi <zakariatalbi@eprosima.com>
Co-authored-by: Zakaria Talbi Lalmi <zakariatalbi@eprosima.com>
Reviewed-by: cferreiragonz <carlosferreira@eprosima.com>

Author: MiguelCompany

src/cpp/fastdds/core/Time_t.cpp

@@ -57,14 +57,16 @@ void Time_t::fraction(
 
 uint32_t Time_t::fraction() const
 {
-    uint32_t fraction = (nanosec == 0xffffffff)
-        ? 0xffffffff
-        : nano_to_frac(nanosec);
+    constexpr uint32_t infinite_fraction = 0xffffffff;
+    constexpr uint32_t max_fraction = infinite_fraction - 1;
 
-    if (fraction != 0xffffffff)
+    uint32_t fraction = infinite_fraction;
+    uint64_t nanosec_64 = nanosec;
+    if (nanosec_64 < C_NANOSECONDS_PER_SEC)
     {
+        fraction = nano_to_frac(nanosec);
         uint32_t nano_check = frac_to_nano(fraction);
-        while (nano_check != nanosec)
+        while ((nano_check != nanosec) && (fraction < max_fraction))
         {
             nano_check = frac_to_nano(++fraction);
         }

src/cpp/fastdds/core/policy/QosPolicyUtils.cpp

@@ -18,6 +18,7 @@
  */
 
 #include <fastdds/core/policy/QosPolicyUtils.hpp>
+#include <fastdds/dds/core/Time_t.hpp>
 
 #include <utils/Host.hpp>
 
@@ -38,6 +39,23 @@ uint64_t default_domain_id()
     return id;
 }
 
+bool is_duration_consistent(
+        const Duration_t& duration,
+        bool allow_infinite)
+{
+    if (duration.is_infinite())
+    {
+        return allow_infinite;
+    }
+
+    if (duration.seconds < 0 || duration.nanosec >= 1000000000)
+    {
+        return false;
+    }
+
+    return true;
+}
+
 }  // namespace utils
 }  // namespace dds
 }  // namespace fastdds

src/cpp/fastdds/core/policy/QosPolicyUtils.hpp

@@ -20,7 +20,9 @@
 #ifndef _FASTDDS_DDS_QOS_QOSPOLICYUTILS_HPP_
 #define _FASTDDS_DDS_QOS_QOSPOLICYUTILS_HPP_
 
-#include <stdint.h>
+#include <cstdint>
+
+#include <fastdds/dds/core/Time_t.hpp>
 
 namespace eprosima {
 namespace fastdds {
@@ -30,6 +32,18 @@ namespace utils {
 // Compute the default DataSharing domain ID
 uint64_t default_domain_id();
 
+/**
+ * @brief Checks if a Duration_t is consistent, i.e. seconds is non-negative, and nanosec is less than 1 second.
+ *
+ * @param duration Duration to check.
+ * @param allow_infinite Whether to allow infinite duration.
+ *
+ * @return true if the duration is consistent, false otherwise.
+ */
+bool is_duration_consistent(
+        const Duration_t& duration,
+        bool allow_infinite = true);
+
 }  // namespace utils
 }  // namespace dds
 }  // namespace fastdds

src/cpp/fastdds/publisher/DataWriterImpl.cpp

@@ -2134,6 +2134,33 @@ ReturnCode_t DataWriterImpl::check_qos(
                                   << "'" << qos.resource_limits().max_samples_per_instance << "'.");
         return RETCODE_INCONSISTENT_POLICY;
     }
+    // Check for nanoseconds in all duration policies
+    if (!utils::is_duration_consistent(qos.deadline().period))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Deadline period is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (!utils::is_duration_consistent(qos.lifespan().duration))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Lifespan duration is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (!utils::is_duration_consistent(qos.liveliness().lease_duration))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Liveliness lease duration is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (!utils::is_duration_consistent(qos.liveliness().announcement_period))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Liveliness announcement period is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (qos.reliability().kind == RELIABLE_RELIABILITY_QOS &&
+            !utils::is_duration_consistent(qos.reliability().max_blocking_time, false))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Reliability max blocking time is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
     return RETCODE_OK;
 }
 

src/cpp/fastdds/subscriber/DataReaderImpl.cpp

@@ -1627,6 +1627,33 @@ ReturnCode_t DataReaderImpl::check_qos(
                                   << "'" << qos.resource_limits().max_samples_per_instance << "'.");
         return RETCODE_INCONSISTENT_POLICY;
     }
+    // Check for nanoseconds in all duration policies
+    if (!utils::is_duration_consistent(qos.deadline().period))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Deadline period is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (!utils::is_duration_consistent(qos.lifespan().duration))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Lifespan duration is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (!utils::is_duration_consistent(qos.liveliness().lease_duration))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Liveliness lease duration is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (!utils::is_duration_consistent(qos.liveliness().announcement_period))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Liveliness announcement period is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
+    if (qos.reliability().kind == RELIABLE_RELIABILITY_QOS &&
+            !utils::is_duration_consistent(qos.reliability().max_blocking_time, false))
+    {
+        EPROSIMA_LOG_ERROR(DDS_QOS_CHECK, "Reliability max blocking time is not consistent");
+        return RETCODE_INCONSISTENT_POLICY;
+    }
     return RETCODE_OK;
 }
 

src/cpp/fastdds/xtypes/dynamic_types/DynamicDataImpl.cpp

@@ -6488,7 +6488,17 @@ bool DynamicDataImpl::deserialize(
                                     get_enclosing_type(traits<DynamicType>::narrow<DynamicTypeImpl>(
                                                 type->get_descriptor().element_type()));
 
-                            vector_t->resize(sequence_length);
+                            uint32_t bounded_length = sequence_length;
+                            uint32_t max_bound = type->get_descriptor().bound().at(0);
+                            if (max_bound != static_cast<uint32_t>(LENGTH_UNLIMITED) && sequence_length > max_bound)
+                            {
+                                bounded_length = max_bound;
+                                EPROSIMA_LOG_WARNING(DYN_TYPES, "Sequence length "
+                                        << sequence_length << " exceeds the maximum bound of " << max_bound
+                                        << ". Only " << bounded_length << " elements will be deserialized.");
+                            }
+
+                            vector_t->resize(bounded_length);
 
                             for (size_t pos = 0; pos < vector_t->size(); ++pos)
                             {
@@ -6500,13 +6510,26 @@ bool DynamicDataImpl::deserialize(
                             }
 
                             uint32_t count {0};
-                            while (static_cast<uint32_t>(cdr.get_current_position() - offset) < dheader &&
-                                    count < sequence_length)
+                            while ((static_cast<uint32_t>(cdr.get_current_position() - offset) < dheader) &&
+                                    (count < bounded_length))
                             {
                                 cdr.deserialize(vector_t->data()[count]);
                                 ++count;
                             }
 
+                            if (bounded_length < sequence_length)
+                            {
+                                auto tmp_data = traits<DynamicData>::narrow<DynamicDataImpl>(
+                                    DynamicDataFactory::get_instance()->create_data(element_type));
+                                // Skip remaining elements if sequence length exceeds maximum bound
+                                while ((static_cast<uint32_t>(cdr.get_current_position() - offset) < dheader) &&
+                                        (count < sequence_length))
+                                {
+                                    cdr.deserialize(tmp_data);
+                                    ++count;
+                                }
+                            }
+
                             if (static_cast<uint32_t>(cdr.get_current_position() - offset) != dheader)
                             {
                                 throw fastcdr::exception::BadParamException(
@@ -6531,7 +6554,18 @@ bool DynamicDataImpl::deserialize(
                                                 type->get_descriptor().element_type()));
                             try
                             {
-                                vector_t->resize(sequence_length);
+                                uint32_t bounded_length = sequence_length;
+                                uint32_t max_bound = type->get_descriptor().bound().at(0);
+                                if (max_bound != static_cast<uint32_t>(LENGTH_UNLIMITED) && sequence_length > max_bound)
+                                {
+                                    bounded_length = max_bound;
+                                    EPROSIMA_LOG_WARNING(DYN_TYPES, "Sequence length "
+                                            << sequence_length << " exceeds the maximum bound of "
+                                            << max_bound << ". Only "
+                                            << bounded_length << " elements will be deserialized.");
+                                }
+
+                                vector_t->resize(bounded_length);
                                 for (size_t pos = 0; pos < vector_t->size(); ++pos)
                                 {
                                     if (!vector_t->at(pos))
@@ -6541,6 +6575,17 @@ bool DynamicDataImpl::deserialize(
                                     }
                                 }
                                 cdr.deserialize_array(vector_t->data(), vector_t->size());
+
+                                if (bounded_length < sequence_length)
+                                {
+                                    auto tmp_data = traits<DynamicData>::narrow<DynamicDataImpl>(
+                                        DynamicDataFactory::get_instance()->create_data(element_type));
+                                    // Skip remaining elements if sequence length exceeds maximum bound
+                                    for (uint32_t count = bounded_length; count < sequence_length; ++count)
+                                    {
+                                        cdr.deserialize(tmp_data);
+                                    }
+                                }
                             }
                             catch (fastcdr::exception::Exception& ex)
                             {

src/cpp/rtps/messages/MessageReceiver.cpp

@@ -1027,7 +1027,16 @@ bool MessageReceiver::proc_Submsg_DataFrag(
     }
 
     uint32_t payload_size;
-    payload_size = smh->submessageLength - (RTPSMESSAGE_DATA_EXTRA_INLINEQOS_SIZE + octetsToInlineQos + inlineQosSize);
+    const uint32_t submsg_no_payload_size = RTPSMESSAGE_DATA_EXTRA_INLINEQOS_SIZE + octetsToInlineQos + inlineQosSize;
+    if (smh->submessageLength < submsg_no_payload_size)
+    {
+        EPROSIMA_LOG_WARNING(RTPS_MSG_IN, IDSTRING "Serialized Payload avoided underflow "
+                "(" << smh->submessageLength << "/" << submsg_no_payload_size << ")");
+        ch.serializedPayload.data = nullptr;
+        ch.inline_qos.data = nullptr;
+        return false;
+    }
+    payload_size = smh->submessageLength - submsg_no_payload_size;
 
     // Validations??? XXX TODO
 

src/cpp/rtps/security/SecurityManager.cpp

@@ -95,6 +95,7 @@ SecurityManager::SecurityManager(
     , participant_(participant)
     , factory_(plugin_factory)
     , domain_id_(0)
+    , max_discovered_participants_(pattr.allocation.participants.maximum)
     , auth_last_sequence_number_(1)
     , crypto_last_sequence_number_(1)
     , temp_reader_proxies_({
@@ -618,28 +619,48 @@ bool SecurityManager::discovered_participant(
     AuthenticationStatus auth_status = AUTHENTICATION_INIT;
 
     // Create or find information
-    bool undiscovered = false;
+    bool newly_discovered = false;
     DiscoveredParticipantInfo::AuthUniquePtr remote_participant_info;
     // Use the information from the collection
     const ParticipantProxyData* remote_participant_data = nullptr;
     {
         std::lock_guard<shared_mutex> _(mutex_);
 
-        auto map_ret = discovered_participants_.insert(
-            std::make_pair(
+        auto dp_it = discovered_participants_.lower_bound(participant_data.guid);
+        if ((dp_it != discovered_participants_.end()) && (dp_it->first == participant_data.guid))
+        {
+            // Already exists, use the information from the collection
+            remote_participant_info = dp_it->second->get_auth();
+            remote_participant_data = &dp_it->second->participant_data();
+        }
+        else if (discovered_participants_.size() < max_discovered_participants_)
+        {
+            // Create new element, because it is not discovered yet
+            auto map_ret = discovered_participants_.emplace_hint(
+                dp_it,
                 participant_data.guid,
                 std::unique_ptr<DiscoveredParticipantInfo>(
-                    new DiscoveredParticipantInfo(
-                        auth_status,
-                        participant_data))));
+                    new DiscoveredParticipantInfo(auth_status, participant_data)));
 
-        undiscovered = map_ret.second;
-        remote_participant_info = map_ret.first->second->get_auth();
-        remote_participant_data = &map_ret.first->second->participant_data();
+            // New element, so mark as newly_discovered
+            newly_discovered = true;
+            // Use the recently created information from the collection
+            remote_participant_info = map_ret->second->get_auth();
+            remote_participant_data = &map_ret->second->participant_data();
+        }
+        else
+        {
+            // Using info level to avoid clogging the logs, since this could be triggered by an attacker flooding the
+            // network with fake participants.
+            EPROSIMA_LOG_INFO(SECURITY,
+                    "Maximum number of discovered participants reached. Ignoring participant "
+                    << participant_data.guid);
+            return false;
+        }
     }
 
     bool notify_part_authorized = false;
-    if (undiscovered && remote_participant_info && remote_participant_data != nullptr)
+    if (newly_discovered && remote_participant_info && remote_participant_data != nullptr)
     {
         // Configure the timed event but do not start it
         const GUID_t guid = remote_participant_data->guid;

src/cpp/rtps/security/SecurityManager.h

@@ -834,6 +834,9 @@ class SecurityManager : private WriterListener
     // synchronization
     std::map<GUID_t, std::unique_ptr<DiscoveredParticipantInfo>> discovered_participants_;
 
+    // Maximum allowed size for the collection of discovered participants.
+    const size_t max_discovered_participants_;
+
     GUID_t auth_source_guid;
 
     /**