Skip to content

Commit 1fb3ac9

Browse files
committed
Added Bound check for UDP length
1 parent 77caa3d commit 1fb3ac9

1 file changed

Lines changed: 10 additions & 0 deletions

File tree

src/platform/datapath_raw_socket.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,16 @@ CxPlatDpRawParseUdp(
177177
return;
178178
}
179179

180+
if (QuicNetByteSwapShort(Udp->Length) < sizeof(UDP_HEADER)) {
181+
QuicTraceEvent(
182+
DatapathErrorStatus,
183+
"[data][%p] ERROR, %u, %s.",
184+
Datapath,
185+
QuicNetByteSwapShort(Udp->Length),
186+
"UDP Length smaller than header size");
187+
return;
188+
}
189+
180190
Packet->Reserved = L4_TYPE_UDP;
181191

182192
Packet->Route->RemoteAddress.Ipv4.sin_port = Udp->SourcePort;

0 commit comments

Comments
 (0)