From 096b0d6c6e54b7c2eed53949e580a473cbe16939 Mon Sep 17 00:00:00 2001
From: thorpej <thorpej@NetBSD.org>
Date: Fri, 25 Oct 1996 06:35:16 +0000
Subject: [PATCH] In udp_output(), sanity check the length of the packet to be
 transmitted. If it's larger than IP_MAXPACKET, return an error condition.
 Based on a patch from Bill Fenner <fenner@parc.xerox.com>

---
 sys/netinet/udp_usrreq.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 4c1eb74c2ce3..0fcde42f64f5 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: udp_usrreq.c,v 1.38 1996/10/16 19:33:39 ws Exp $	*/
+/*	$NetBSD: udp_usrreq.c,v 1.39 1996/10/25 06:35:16 thorpej Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1988, 1990, 1993
@@ -449,6 +449,15 @@ udp_output(m, va_alist)
 		goto release;
 	}
 
+	/*
+	 * Compute the packet length of the IP header, and
+	 * punt if the length looks bogus.
+	 */
+	if ((len + sizeof(struct udpiphdr)) > IP_MAXPACKET) {
+		error = EMSGSIZE;
+		goto release;
+	}
+
 	/*
 	 * Fill in mbuf with extended UDP header
 	 * and addresses and length put into network format.