X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fprotocol_misc.c;h=0263d0016843eea310a90bf7a41e9183d68b0049;hb=a5c6c6ea1ab657d83a4d8b064ac9bfa9c16adf63;hp=cef7e3d08fa218c7d62806e6cde4db11eda8e593;hpb=5a76af7839d3239a16a6a3f9dabe05768799de89;p=tinc

diff --git a/src/protocol_misc.c b/src/protocol_misc.c
index cef7e3d0..0263d001 100644
--- a/src/protocol_misc.c
+++ b/src/protocol_misc.c
@@ -104,7 +104,7 @@ bool send_tcppacket(connection_t *c, const vpn_packet_t *packet) {
 bool tcppacket_h(connection_t *c, const char *request) {
 	short int len;
 
-	if(sscanf(request, "%*d %hd", &len) != 1) {
+	if(sscanf(request, "%*d %hd", &len) != 1 || len < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "PACKET", c->name,
 		       c->hostname);
 		return false;
@@ -136,7 +136,7 @@ bool send_sptps_tcppacket(connection_t *c, const void *packet, size_t len) {
 bool sptps_tcppacket_h(connection_t *c, const char *request) {
 	short int len;
 
-	if(sscanf(request, "%*d %hd", &len) != 1) {
+	if(sscanf(request, "%*d %hd", &len) != 1 || len < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "SPTPS_PACKET", c->name,
 		       c->hostname);
 		return false;