|
@@ -665,7 +665,8 @@ enet_protocol_handle_send_unreliable_fragment (ENetHost * host, ENetPeer * peer,
|
|
|
|
|
|
fragmentLength = ENET_NET_TO_HOST_16 (command -> sendFragment.dataLength);
|
|
|
* currentData += fragmentLength;
|
|
|
- if (fragmentLength > host -> maximumPacketSize ||
|
|
|
+ if (fragmentLength <= 0 ||
|
|
|
+ fragmentLength > host -> maximumPacketSize ||
|
|
|
* currentData < host -> receivedData ||
|
|
|
* currentData > & host -> receivedData [host -> receivedDataLength])
|
|
|
return -1;
|
|
@@ -695,6 +696,7 @@ enet_protocol_handle_send_unreliable_fragment (ENetHost * host, ENetPeer * peer,
|
|
|
if (fragmentCount > ENET_PROTOCOL_MAXIMUM_FRAGMENT_COUNT ||
|
|
|
fragmentNumber >= fragmentCount ||
|
|
|
totalLength > host -> maximumPacketSize ||
|
|
|
+ totalLength < fragmentCount ||
|
|
|
fragmentOffset >= totalLength ||
|
|
|
fragmentLength > totalLength - fragmentOffset)
|
|
|
return -1;
|