diff --git a/src/udp6.c b/src/udp6.c index 18ce998d7c156ffb1f9609d0d63a72e567d03f72..efeac5c19ad03dbf0af59a6a2a4f6ac0c9a5c939 100644 --- a/src/udp6.c +++ b/src/udp6.c @@ -31,7 +31,10 @@ void udp6_input(struct mbuf *m) ip = mtod(m, struct ip6 *); m->m_len -= iphlen; m->m_data += iphlen; - uh = mtod(m, struct udphdr *); + uh = mtod_check(m, sizeof(struct udphdr)); + if (uh == NULL) { + goto bad; + } m->m_len += iphlen; m->m_data -= iphlen;