diff --git a/src/netif/ppp/ppp.c b/src/netif/ppp/ppp.c index dcefd3a6..4e7667e1 100644 --- a/src/netif/ppp/ppp.c +++ b/src/netif/ppp/ppp.c @@ -930,6 +930,10 @@ void ppp_input(ppp_pcb *pcb, struct pbuf *pb) { for (i = 0; (protp = protocols[i]) != NULL; ++i) { if (protp->protocol == protocol) { pb = pbuf_coalesce(pb, PBUF_RAW); + if (pb->next != NULL) { + PPPDEBUG(LOG_WARNING, ("ppp_input[%d]: Dropping (pbuf_coalesce failed), len=%d\n", pcb->netif->num, pb->tot_len)); + goto drop; + } (*protp->input)(pcb, (u8_t*)pb->payload, pb->len); goto out; } diff --git a/src/netif/ppp/pppoe.c b/src/netif/ppp/pppoe.c index 5098d8dd..ee85af4f 100644 --- a/src/netif/ppp/pppoe.c +++ b/src/netif/ppp/pppoe.c @@ -410,6 +410,10 @@ pppoe_disc_input(struct netif *netif, struct pbuf *pb) } pb = pbuf_coalesce(pb, PBUF_RAW); + if (pb->next != NULL) { + PPPDEBUG(LOG_DEBUG, ("pppoe: pbuf_coalesce failed: %d\n", pb->tot_len)); + goto done; + } ethhdr = (struct eth_hdr *)pb->payload; diff --git a/src/netif/ppp/pppol2tp.c b/src/netif/ppp/pppol2tp.c index 6a35233c..15ea2ae5 100644 --- a/src/netif/ppp/pppol2tp.c +++ b/src/netif/ppp/pppol2tp.c @@ -530,6 +530,11 @@ static void pppol2tp_dispatch_control_packet(pppol2tp_pcb *l2tp, u16_t port, str l2tp->peer_ns = ns+1; p = pbuf_coalesce(p, PBUF_RAW); + if (p->next != NULL) { + PPPDEBUG(LOG_DEBUG, ("pppol2tp: pbuf_coalesce failed: %d\n", p->tot_len)); + return; + } + inp = (u8_t*)p->payload; /* Decode AVPs */ while (p->len > 0) {