summaryrefslogtreecommitdiff
path: root/src/transport/gnunet-service-tng.c
diff options
context:
space:
mode:
authorChristian Grothoff <christian@grothoff.org>2019-06-04 21:05:01 +0200
committerChristian Grothoff <christian@grothoff.org>2019-06-04 21:05:10 +0200
commit14537ef71b43ac47fe342c4e88f7bd3675ed1e39 (patch)
tree6833f549f695ba40533ba716caebc1866415e359 /src/transport/gnunet-service-tng.c
parent0e6553e41d132726eb8f7964b581bb2cac0e6b6c (diff)
misc bugfixes
Diffstat (limited to 'src/transport/gnunet-service-tng.c')
-rw-r--r--src/transport/gnunet-service-tng.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/transport/gnunet-service-tng.c b/src/transport/gnunet-service-tng.c
index 9262e5e97..206c59363 100644
--- a/src/transport/gnunet-service-tng.c
+++ b/src/transport/gnunet-service-tng.c
@@ -5580,6 +5580,13 @@ handle_fragment_box (void *cls, const struct TransportFragmentBoxMessage *fb)
return;
}
frag_off = ntohs (fb->frag_off);
+ if (frag_off + fsize > msize)
+ {
+ /* Fragment (plus fragment size) exceeds message size! */
+ GNUNET_break_op (0);
+ finish_cmc_handling (cmc);
+ return;
+ }
memcpy (&target[frag_off], &fb[1], fsize);
/* update bitfield and msg_missing */
for (unsigned int i = frag_off; i < frag_off + fsize; i++)