X-Git-Url: http://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=NeXT%2Fvjcompress.c;h=0a0a29a3929dabd9a2a963c0b70d4c6e55b5a6d1;hp=237b1ff78958717a1998c389c1bb95fa1acabd6b;hb=31e80dd05aec83cbee14a9ede031023188e31270;hpb=7554d5fef3f478ca0f9c8911522d7c1783989eae

diff --git a/NeXT/vjcompress.c b/NeXT/vjcompress.c
index 237b1ff..0a0a29a 100644
--- a/NeXT/vjcompress.c
+++ b/NeXT/vjcompress.c
@@ -29,7 +29,7 @@
  * This version is used under SunOS 4.x, DEC Alpha OSF/1, AIX 4.x,
  * and SVR4 systems including Solaris 2.
  *
- * $Id: vjcompress.c,v 1.1 1995/12/18 03:30:20 paulus Exp $
+ * $Id: vjcompress.c,v 1.2 1996/05/24 07:04:06 paulus Exp $
  */
 
 #include <sys/types.h>
@@ -439,7 +439,12 @@ vj_uncompress_uncomp(buf, comp)
     register struct ip *ip;
 
     ip = (struct ip *) buf;
-    if (ip->ip_p >= MAX_STATES) {
+    hlen = getip_hl(*ip) << 2;
+    if (ip->ip_p >= MAX_STATES
+	|| hlen + sizeof(struct tcphdr) > buflen
+	|| (hlen += getth_off(*((struct tcphdr *)&((char *)ip)[hlen])) << 2)
+	    > buflen
+	|| hlen > MAX_HDR) {
 	comp->flags |= VJF_TOSS;
 	INCR(vjs_errorin);
 	return (0);
@@ -447,9 +452,6 @@ vj_uncompress_uncomp(buf, comp)
     cs = &comp->rstate[comp->last_recv = ip->ip_p];
     comp->flags &=~ VJF_TOSS;
     ip->ip_p = IPPROTO_TCP;
-    hlen = getip_hl(*ip);
-    hlen += getth_off(*((struct tcphdr *)&((int *)ip)[hlen]));
-    hlen <<= 2;
     BCOPY(ip, &cs->cs_ip, hlen);
     cs->cs_hlen = hlen;
     INCR(vjs_uncompressedin);