diff options
Diffstat (limited to 'src/transport/gnunet-service-tng.c')
-rw-r--r-- | src/transport/gnunet-service-tng.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/transport/gnunet-service-tng.c b/src/transport/gnunet-service-tng.c index 9262e5e97..206c59363 100644 --- a/src/transport/gnunet-service-tng.c +++ b/src/transport/gnunet-service-tng.c | |||
@@ -5580,6 +5580,13 @@ handle_fragment_box (void *cls, const struct TransportFragmentBoxMessage *fb) | |||
5580 | return; | 5580 | return; |
5581 | } | 5581 | } |
5582 | frag_off = ntohs (fb->frag_off); | 5582 | frag_off = ntohs (fb->frag_off); |
5583 | if (frag_off + fsize > msize) | ||
5584 | { | ||
5585 | /* Fragment (plus fragment size) exceeds message size! */ | ||
5586 | GNUNET_break_op (0); | ||
5587 | finish_cmc_handling (cmc); | ||
5588 | return; | ||
5589 | } | ||
5583 | memcpy (&target[frag_off], &fb[1], fsize); | 5590 | memcpy (&target[frag_off], &fb[1], fsize); |
5584 | /* update bitfield and msg_missing */ | 5591 | /* update bitfield and msg_missing */ |
5585 | for (unsigned int i = frag_off; i < frag_off + fsize; i++) | 5592 | for (unsigned int i = frag_off; i < frag_off + fsize; i++) |