AIKIDO-2026-728978

TL;DR

Fast DDS receives RTPS DATA_FRAG submessages and reassembles fragmented samples. When handling the last fragment, the code derives the copy length from the wire-provided sampleSize field without confirming the datagram size. A crafted fragment with an inflated sampleSize and a short payload causes a memcpy() to read past the packet buffer into adjacent memory, whose contents can then be relayed to newly joining participants through the Discovery Server. The fix validates the incoming data length before copying so out-of-bounds bytes are never read.