Prevent underflow when sending UDP probes.

Make sure send_udp_probe_packet() never tries to send a packet smaller
than MIN_PROBE_SIZE, otherwise length calculation could potentially wrap.

Fixes #351 on GitHub.

diff --git a/src/net_packet.c b/src/net_packet.c
index 2722fb2..5bdcb1a 100644 (file)
--- a/src/net_packet.c
+++ b/src/net_packet.c
@@ -1171,6 +1171,7 @@ static void send_udp_probe_packet(node_t *n, size_t len) {
                len = sizeof(packet.data);
        }
 
+       len = MAX(len, MIN_PROBE_SIZE);
        packet.offset = DEFAULT_PACKET_OFFSET;
        memset(DATA(&packet), 0, 14);
        randomize(DATA(&packet) + 14, len - 14);