diff options
Diffstat (limited to 'src/ipcpd/eth/eth.c')
| -rw-r--r-- | src/ipcpd/eth/eth.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/ipcpd/eth/eth.c b/src/ipcpd/eth/eth.c index d2e7a7c8..29c5ff4f 100644 --- a/src/ipcpd/eth/eth.c +++ b/src/ipcpd/eth/eth.c @@ -138,7 +138,7 @@ #define NAME_QUERY_TIMEO 2000 /* ms */ #define MGMT_TIMEO 100 /* ms */ -#define MGMT_FRAME_SIZE 2048 +#define MGMT_FRAME_SIZE IPCP_ETH_MGMT_FRAME_SIZE #define FLOW_REQ 0 #define FLOW_REPLY 1 @@ -937,6 +937,12 @@ static void * eth_ipcp_packet_reader(void * o) #endif ipcp_sdb_release(sdb); /* No need for the N+1 buffer. */ + if (length > MGMT_FRAME_SIZE) { + log_warn("Management frame size %u exceeds %u.", + length, MGMT_FRAME_SIZE); + goto fail_frame; + } + frame = malloc(sizeof(*frame)); if (frame == NULL) { log_err("Failed to allocate frame."); |