X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fprotocol_misc.c;h=0263d0016843eea310a90bf7a41e9183d68b0049;hb=c45a3fd7319d03bd147448a017f5aaed3b46fdfe;hp=cef7e3d08fa218c7d62806e6cde4db11eda8e593;hpb=28b7a53b693f6b4e70218a926e68a36ece54cda1;p=tinc

diff --git a/src/protocol_misc.c b/src/protocol_misc.c
index cef7e3d0..0263d001 100644
--- a/src/protocol_misc.c
+++ b/src/protocol_misc.c
@@ -104,7 +104,7 @@ bool send_tcppacket(connection_t *c, const vpn_packet_t *packet) {
 bool tcppacket_h(connection_t *c, const char *request) {
 	short int len;
 
-	if(sscanf(request, "%*d %hd", &len) != 1) {
+	if(sscanf(request, "%*d %hd", &len) != 1 || len < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "PACKET", c->name,
 		       c->hostname);
 		return false;
@@ -136,7 +136,7 @@ bool send_sptps_tcppacket(connection_t *c, const void *packet, size_t len) {
 bool sptps_tcppacket_h(connection_t *c, const char *request) {
 	short int len;
 
-	if(sscanf(request, "%*d %hd", &len) != 1) {
+	if(sscanf(request, "%*d %hd", &len) != 1 || len < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "SPTPS_PACKET", c->name,
 		       c->hostname);
 		return false;