ping: fixed input pbuf processing when using raw API (check p->tot_len before calling pbuf_header)

This commit is contained in:
Simon Goldschmidt 2011-09-22 21:12:06 +02:00
parent 52aa714af2
commit 288914b5c0
1 changed files with 2 additions and 1 deletions

View File

@ -236,7 +236,8 @@ ping_recv(void *arg, struct raw_pcb *pcb, struct pbuf *p, ip_addr_t *addr)
LWIP_UNUSED_ARG(addr);
LWIP_ASSERT("p != NULL", p != NULL);
if (pbuf_header( p, -PBUF_IP_HLEN)==0) {
if ((p->tot_len >= (PBUF_IP_HLEN + sizeof(struct icmp_echo_hdr))) &&
pbuf_header( p, -PBUF_IP_HLEN) == 0) {
iecho = (struct icmp_echo_hdr *)p->payload;
if ((iecho->id == PING_ID) && (iecho->seqno == htons(ping_seq_num))) {