Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet/udp_usrreq.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/udp_usrreq.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.69
retrieving revision 1.70
diff -u -p -r1.69 -r1.70
--- src/sys/netinet/udp_usrreq.c	2000/07/07 15:54:16	1.69
+++ src/sys/netinet/udp_usrreq.c	2000/07/24 03:46:57	1.70
@@ -1,4 +1,4 @@
-/*	$NetBSD: udp_usrreq.c,v 1.69 2000/07/07 15:54:16 itojun Exp $	*/
+/*	$NetBSD: udp_usrreq.c,v 1.70 2000/07/24 03:46:57 sommerfeld Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -231,7 +231,7 @@ udp_input(m, va_alist)
 	 */
 	len = ntohs((u_int16_t)uh->uh_ulen);
 	if (ip->ip_len != iphlen + len) {
-		if (ip->ip_len < iphlen + len) {
+		if (ip->ip_len < iphlen + len || len < sizeof(struct udphdr)) {
 			udpstat.udps_badlen++;
 			goto bad;
 		}
@@ -914,7 +914,7 @@ udp_input(m, va_alist)
 	 */
 	len = ntohs((u_int16_t)uh->uh_ulen);
 	if (ip->ip_len != iphlen + len) {
-		if (ip->ip_len < iphlen + len) {
+		if (ip->ip_len < iphlen + len || len < sizeof(struct udphdr)) {
 			udpstat.udps_badlen++;
 			goto bad;
 		}