diff options
Diffstat (limited to 'freebsd/sys/netinet/ip_reass.c')
| -rw-r--r-- | freebsd/sys/netinet/ip_reass.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/freebsd/sys/netinet/ip_reass.c b/freebsd/sys/netinet/ip_reass.c index 95603390..8bc5b53b 100644 --- a/freebsd/sys/netinet/ip_reass.c +++ b/freebsd/sys/netinet/ip_reass.c @@ -230,6 +230,16 @@ ip_reass(struct mbuf *m) ip->ip_off = htons(ntohs(ip->ip_off) << 3); /* + * Make sure the fragment lies within a packet of valid size. + */ + if (ntohs(ip->ip_len) + ntohs(ip->ip_off) > IP_MAXPACKET) { + IPSTAT_INC(ips_toolong); + IPSTAT_INC(ips_fragdropped); + m_freem(m); + return (NULL); + } + + /* * Attempt reassembly; if it succeeds, proceed. * ip_reass() will return a different mbuf. */ |