From c23142a8ffc35088047060989fc3d76c5b4e00af Mon Sep 17 00:00:00 2001
From: dnobori <da.git@softether.co.jp>
Date: Mon, 15 Jan 2018 11:38:44 +0900
Subject: v4.25-9656-rtm

---
 src/Cedar/IPsec_L2TP.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'src/Cedar/IPsec_L2TP.c')

diff --git a/src/Cedar/IPsec_L2TP.c b/src/Cedar/IPsec_L2TP.c
index 79860153..e036e1a5 100644
--- a/src/Cedar/IPsec_L2TP.c
+++ b/src/Cedar/IPsec_L2TP.c
@@ -792,6 +792,12 @@ L2TP_PACKET *ParseL2TPPacket(UDPPACKET *p)
 			size -= 2;
 
 			a.DataSize = a.Length - 6;
+
+			if (a.DataSize > size)
+			{
+				goto LABEL_ERROR;
+			}
+
 			a.Data = Clone(buf, a.DataSize);
 
 			buf += a.DataSize;
-- 
cgit v1.2.3