From: Roy Marples <roy@marples.name>
Date: Sat, 20 Jun 2026 20:57:45 +0000 (+0100)
Subject: ARP: check we have enough to read the frame header
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4f426005de7270939d43c1f87e442f7a488589e8;p=thirdparty%2Fdhcpcd.git

ARP: check we have enough to read the frame header

Reported by NVIDIA Project Vanessa
---

diff --git a/src/arp.c b/src/arp.c
index 7d4f1e78..9c318be2 100644
--- a/src/arp.c
+++ b/src/arp.c
@@ -245,6 +245,8 @@ arp_packet(struct interface *ifp, uint8_t *data, size_t len,
 	/* Copy the frame header source and destination out */
 	memset(&arm, 0, sizeof(arm));
 	if (fl != 0) {
+		if (len < fl)
+			return;
 		hw_s = bpf_frame_header_src(ifp, data, &falen);
 		if (hw_s != NULL && falen <= sizeof(arm.fsha))
 			memcpy(arm.fsha, hw_s, falen);