File wireshark-0015-CVE-2026-0960.patch of Package wireshark.42256

commit f31123dcdbac37272046b58b2f7941bc7fb42934
Author: John Thacker <johnthacker@gmail.com>
Date:   Mon Jan 12 15:28:22 2026 +0000

    QUIC: Update reassembly ID for a new MSP
    
    When a QUIC frame has more than one MSP, the reassembly id for the
    second MSP has to be used when adding or looking it up, instead of
    the original reassembly id of the first MSP.
    
    Fixes reassembly of the file in #20944 in most cases, outside of issues
    with out of order UDP packets / QUIC packets.
    
    
    (cherry picked from commit 562c3c070c6f58d01904d42338489b1a64ad7655)
    
    Co-authored-by: John Thacker <johnthacker@gmail.com>

diff --git a/epan/dissectors/packet-quic.c b/epan/dissectors/packet-quic.c
index b144abc13c..ed56d4dca4 100644
--- a/epan/dissectors/packet-quic.c
+++ b/epan/dissectors/packet-quic.c
@@ -1825,9 +1825,10 @@ again:
                         deseg_seq, nxtseq+pinfo->desegment_len, stream->multisegment_pdus);
                 }
 
-                /* add this segment as the first one for this new pdu */
+                /* Add this segment as the first one for this new pdu.
+                 * Use the the new MSP's reassembly ID (its first frame). */
                 fragment_add(&quic_reassembly_table, tvb, deseg_offset,
-                             pinfo, reassembly_id, NULL,
+                             pinfo, msp->first_frame, stream_info,
                              0, nxtseq - deseg_seq,
                              nxtseq < msp->nxtpdu);
             }
@@ -1836,7 +1837,7 @@ again:
              * know what later frame the PDU is reassembled in.
              */
             if ((msp = (struct tcp_multisegment_pdu *)wmem_tree_lookup32(stream->multisegment_pdus, deseg_seq))) {
-                fh = fragment_get(&quic_reassembly_table, pinfo, reassembly_id, NULL);
+                fh = fragment_get(&quic_reassembly_table, pinfo, msp->first_frame, stream_info);
             }
         }
     }