GHSA-qh5x-rfwf-rvfv

### Summary An authenticated client can crash the Hysteria server by advertising a very small QUIC `max_datagram_frame_size` and then triggering a UDP response from the server. When the server tries to send the UDP response back via QUIC DATAGRAM, quic-go returns `DatagramTooLargeError`. The server then attempts to fragment the Hysteria UDP message, but the fragmentation code does not handle the case where the UDP message header itself is larger than the maximum datagram payload size. This results in a slice bounds panic and terminates the server process. ### Details The vulnerable path is the normal server-side UDP response path: ```text udpSessionEntry.receiveLoop -> sendMessageAutoFrag -> frag.FragUDPMessage ``` In `core/server/udp.go`, `receiveLoop` packages a UDP response into a `protocol.UDPMessage` and calls `sendMessageAutoFrag`. If `SendDatagram` fails with `quic.DatagramTooLargeError`, `sendMessageAutoFrag` calls: ```go fMsgs := frag.FragUDPMessage(msg, int(errTooLarge.MaxDatagramPayloadSize)) ``` However, `FragUDPMessage` in `core/internal/frag/frag.go` assumes that `maxSize` is greater than the UDP message header size: ```go maxPayloadSize := maxSize - m.HeaderSize() ``` If an attacker-controlled client advertises a small enough `max_datagram_frame_size`, `errTooLarge.MaxDatagramPayloadSize` can be smaller than `m.HeaderSize()`. In that case, `maxPayloadSize` becomes zero or negative, and the later slicing operation panics: ```go frag.Data = fullPayload[off : off+payloadSize] ``` ### PoC poc.yaml ```yaml listen: 127.0.0.1:8443 tls: cert: poc_server.crt key: poc_server.key auth: type: password password: udp-frag-panic-poc masquerade: type: string string: content: nope statusCode: 404 ``` poc.go ```go //go:build poc package main import ( "bytes" "context" "crypto/tls" "encoding/binary" "flag" "fmt" "io" "net" "net/http" "net/url" "time" "github.com/apernet/quic-go" "github.com/apernet/quic-go/h