--- mheardd.orig.c 2003-11-16 21:52:10.000000000 +0100 +++ mheardd.c 2003-11-16 22:01:03.000000000 +0100 @@ -228,14 +228,14 @@ syslog(LOG_WARNING, "packet too short\n"); continue; } - - mheard = findentry((ax25_address *)(data + AXLEN), port); - + if (!ax25_validate(data + 0) || !ax25_validate(data + AXLEN)) { if (logging) syslog(LOG_WARNING, "invalid callsign on port %s\n", port); continue; } + + mheard = findentry((ax25_address *)(data + AXLEN), port); memcpy(&mheard->entry.from_call, data + AXLEN, sizeof(ax25_address)); memcpy(&mheard->entry.to_call, data + 0, sizeof(ax25_address)); @@ -248,7 +248,7 @@ data += (AXLEN + AXLEN); size -= (AXLEN + AXLEN); - while (!end) { + while (!end && mheard->entry.ndigis <= 7 && ax25_validate(data) ) { memcpy(&mheard->entry.digis[mheard->entry.ndigis], data, sizeof(ax25_address)); mheard->entry.ndigis++; @@ -257,7 +257,12 @@ data += AXLEN; size -= AXLEN; } - + if (!end) { + if (logging) + syslog(LOG_WARNING, "invalid digipeater field\n"); + continue; + } + if (size == 0) { if (logging) syslog(LOG_WARNING, "packet too short\n");