diff options
| -rw-r--r-- | src/ncsi.c | 4 | ||||
| -rw-r--r-- | src/slirp.c | 4 |
2 files changed, 8 insertions, 0 deletions
@@ -148,6 +148,10 @@ void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len) uint32_t checksum; uint32_t *pchecksum; + if (pkt_len < ETH_HLEN + sizeof(struct ncsi_pkt_hdr)) { + return; /* packet too short */ + } + memset(ncsi_reply, 0, sizeof(ncsi_reply)); memset(reh->h_dest, 0xff, ETH_ALEN); diff --git a/src/slirp.c b/src/slirp.c index dba7c98..9be58e2 100644 --- a/src/slirp.c +++ b/src/slirp.c @@ -756,6 +756,10 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len) return; } + if (pkt_len < ETH_HLEN + sizeof(struct slirp_arphdr)) { + return; /* packet too short */ + } + ar_op = ntohs(ah->ar_op); switch (ar_op) { case ARPOP_REQUEST: |