From dd5c3787dc38373237626796f7efeab63b8418c4 Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@revosec.ch>
Date: Wed, 21 Dec 2011 13:54:40 +0100
Subject: [PATCH] Give a hint that decryption failed if payload length invalid

---
 src/libcharon/encoding/payloads/encryption_payload.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/libcharon/encoding/payloads/encryption_payload.c b/src/libcharon/encoding/payloads/encryption_payload.c
index f3c4b3996..096079ad7 100644
--- a/src/libcharon/encoding/payloads/encryption_payload.c
+++ b/src/libcharon/encoding/payloads/encryption_payload.c
@@ -432,6 +432,13 @@ static status_t parse(private_encryption_payload_t *this, chunk_t plain)
 	{
 		payload_t *payload;
 
+		if (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len)
+		{
+			DBG1(DBG_ENC, "invalid %N payload length, decryption failed?",
+				 payload_type_names, type);
+			parser->destroy(parser);
+			return PARSE_ERROR;
+		}
 		if (parser->parse_payload(parser, type, &payload) != SUCCESS)
 		{
 			parser->destroy(parser);