ARP: check we have enough to read the frame header

Reported by NVIDIA Project Vanessa

diff --git a/src/arp.c b/src/arp.c
index 7d4f1e78c1538055cfa5e4c818dadf6f2457f20f..9c318be2261f959f6307ea48101ad806dcc76c60 100644 (file)
--- a/src/arp.c
+++ b/src/arp.c
@@ -245,6 +245,8 @@ arp_packet(struct interface *ifp, uint8_t *data, size_t len,
        /* Copy the frame header source and destination out */
        memset(&arm, 0, sizeof(arm));
        if (fl != 0) {
+               if (len < fl)
+                       return;
                hw_s = bpf_frame_header_src(ifp, data, &falen);
                if (hw_s != NULL && falen <= sizeof(arm.fsha))
                        memcpy(arm.fsha, hw_s, falen);