diff --git a/u-boot-2020.01/include/net.h b/u-boot-2020.01/include/net.h index 834f2449826a96994738f0252205945ca38a6637..e8a213f43dedbf4e134c4f8854f277f02be51fc7 100644 --- a/u-boot-2020.01/include/net.h +++ b/u-boot-2020.01/include/net.h @@ -373,6 +373,8 @@ struct ip_hdr { #define IP_HDR_SIZE (sizeof(struct ip_hdr)) +#define IP_MIN_FRAG_DATAGRAM_SIZE (IP_HDR_SIZE + 8) + /* * Internet Protocol (IP) + UDP header. */ diff --git a/u-boot-2020.01/net/net.c b/u-boot-2020.01/net/net.c index 5199d679a1fbfc9c3d24d3d0577d7e5a375fe4f4..8fcfc68c9cf3734a0b67e2591d8fdbfd91db803a 100644 --- a/u-boot-2020.01/net/net.c +++ b/u-boot-2020.01/net/net.c @@ -911,6 +911,9 @@ static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp) int offset8, start, len, done = 0; u16 ip_off = ntohs(ip->ip_off); + if (ip->ip_len < IP_MIN_FRAG_DATAGRAM_SIZE) + return NULL; + /* payload starts after IP header, this fragment is in there */ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE); offset8 = (ip_off & IP_OFFS);