diff options
| -rw-r--r-- | sys/net/if_gre.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c index ffd94d8..24ed971 100644 --- a/sys/net/if_gre.c +++ b/sys/net/if_gre.c @@ -691,6 +691,14 @@ gre_input(struct mbuf **mp, int *offp, int proto) KASSERT(sc != NULL, ("encap_getarg returned NULL")); ifp = GRE2IFP(sc); + hlen = *offp + sizeof(struct grehdr) + 4 * sizeof(uint32_t); + if (m->m_pkthdr.len < hlen) + goto drop; + if (m->m_len < hlen) { + m = m_pullup(m, hlen); + if (m == NULL) + goto drop; + } gh = (struct grehdr *)mtodo(m, *offp); flags = ntohs(gh->gre_flags); if (flags & ~GRE_FLAGS_MASK) |
