Fixed bug FICORA #503685.

diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index 3cda384507767662ca469b50f58ab5abf4317bd4..d156474e752a9cafaee1051f431045f3f90a0f1c 100644 (file)
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -312,6 +312,12 @@ ospf_rx_hook(sock *sk, int size)
   }
 
   int osize = ntohs(ps->length);
+  if ((unsigned) osize < sizeof(struct ospf_packet))
+  {
+    log(L_ERR "%s%I - too low value in size field (%u bytes)", mesg, sk->faddr, osize);
+    return 1;
+  }
+
   if ((osize > size) || ((osize % 4) != 0))
   {
     log(L_ERR "%s%I - size field does not match (%d/%d)", mesg, sk->faddr, osize, size);