summaryrefslogtreecommitdiff
path: root/src/transport/gnunet-service-tng.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/transport/gnunet-service-tng.c')
-rw-r--r--src/transport/gnunet-service-tng.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/transport/gnunet-service-tng.c b/src/transport/gnunet-service-tng.c
index 9262e5e97..206c59363 100644
--- a/src/transport/gnunet-service-tng.c
+++ b/src/transport/gnunet-service-tng.c
@@ -5580,6 +5580,13 @@ handle_fragment_box (void *cls, const struct TransportFragmentBoxMessage *fb)
return;
}
frag_off = ntohs (fb->frag_off);
+ if (frag_off + fsize > msize)
+ {
+ /* Fragment (plus fragment size) exceeds message size! */
+ GNUNET_break_op (0);
+ finish_cmc_handling (cmc);
+ return;
+ }
memcpy (&target[frag_off], &fb[1], fsize);
/* update bitfield and msg_missing */
for (unsigned int i = frag_off; i < frag_off + fsize; i++)