From d4b745daca019b050dd09c99d703aae76133428f Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Tue, 1 Sep 2026 14:06:32 -0400
Subject: [PATCH] ms_nrtp: bound NRBF string lengths to 31 bits

AI-Assisted: yes (GPT-5.6-Cyber)
---
 scapy/layers/ms_nrtp.py      |  6 ++++++
 test/scapy/layers/msnrtp.uts | 11 +++++++++++
 2 files changed, 17 insertions(+)

diff --git a/scapy/layers/ms_nrtp.py b/scapy/layers/ms_nrtp.py
index 2af3c6b1d05..b7da04aeb7e 100644
--- a/scapy/layers/ms_nrtp.py
+++ b/scapy/layers/ms_nrtp.py
@@ -17,6 +17,7 @@
 
 from scapy.automaton import Automaton, ATMT
 from scapy.config import conf
+from scapy.error import Scapy_Exception
 from scapy.main import interact
 from scapy.fields import (
     ByteEnumField,
@@ -337,6 +338,11 @@ def __init__(self, name, default, length_of=None):
         FieldLenField.__init__(self, name, default, length_of=length_of)
         super(MSBExtendedFieldLen, self).__init__(name, default)
 
+    def getfield(self, pkt, s):
+        if len(s) >= 5 and min(s[:4]) >= 0x80 and s[4] > 0x07:
+            raise Scapy_Exception("NRBF string length exceeds 31 bits")
+        return super(MSBExtendedFieldLen, self).getfield(pkt, s)
+
     i2m = FieldLenField.i2m
 
 
diff --git a/test/scapy/layers/msnrtp.uts b/test/scapy/layers/msnrtp.uts
index 04a9e46e1a8..accf2d41312 100644
--- a/test/scapy/layers/msnrtp.uts
+++ b/test/scapy/layers/msnrtp.uts
@@ -39,6 +39,17 @@ assert pkt.records[3].Values == b"TRIMMED"
 
 assert isinstance(pkt.records[4], NRBFMessageEnd)
 
+= [MS-NRBF] reject a string length wider than 31 bits
+
+# The over-wide length is meant to be rejected and fall back to Raw, so the
+# debug dissector must not turn that rejection into a raised exception.
+with no_debug_dissector():
+    pkt = NRBF(b"\x0c\x01\x00\x00\x00" + b"\x81" * 5)
+    assert isinstance(pkt.records[0], Raw)
+
+maximum = NRBFLengthPrefixedString(b"\xff\xff\xff\xff\x07")
+assert maximum.Length == 0x7fffffff
+
 = [MS-NRBF] build .NET Binary Format
 
 pkt = NRBF(