From 863e863f93e8be1badea652e881fd25f6031a8d9 Mon Sep 17 00:00:00 2001 From: Tamerlan Salkenov Date: Mon, 13 Jul 2026 21:19:41 +0500 Subject: [PATCH] tap_user: Fix potential bogus header len underflow Signed-off-by: Tamerlan Salkenov --- src/devices/tap_user.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/devices/tap_user.c b/src/devices/tap_user.c index a752f7236..e67d39141 100644 --- a/src/devices/tap_user.c +++ b/src/devices/tap_user.c @@ -757,8 +757,8 @@ static void handle_ipv4(tap_dev_t* tap, const uint8_t* buffer, size_t size) // This is a fragmented frame return; } - if (unlikely(size < total_length)) { - // Encoded size exceeds frame size + if (unlikely(total_length < header_length || size < total_length)) { + // Bogus IP header length or encoded size exceeds frame size return; }