diff --git a/pimd/mtracebis.c b/pimd/mtracebis.c index a073fa70be..731fdb1beb 100644 --- a/pimd/mtracebis.c +++ b/pimd/mtracebis.c @@ -296,6 +296,10 @@ static int recv_response(int fd, int *hops, struct igmp_mtrace *mtracer) mtrace_len = ntohs(ip->ip_len) - ip->ip_hl * 4; + if ((char *)mtrace + mtrace_len + > (char *)mtrace_buf + IP_AND_MTRACE_BUF_LEN) + return -1; + if (mtrace_len < (int)MTRACE_HDR_SIZE) return -1;