X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_if_in.c;h=974227f7a0eac68b38f326c092f4a26ac4c46d6c;hb=f1653e62fe41e3df429aadaaab22d0cc8aaa227a;hp=f9341d62a6824491749395246c94b47ffc4c8acc;hpb=41afb33efe81a93ddf5879138802bf23602ccc81;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c
index f9341d62a68..974227f7a0e 100644
--- a/src/vnet/ipsec/ipsec_if_in.c
+++ b/src/vnet/ipsec/ipsec_if_in.c
@@ -457,7 +457,9 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      else
 		clib_memcpy (&tr->key4, &key40, sizeof (tr->key4));
 	      tr->is_ip6 = is_ip6;
-	      tr->seq = clib_host_to_net_u32 (esp0->seq);
+	      tr->seq =
+		len0 >=
+		sizeof (*esp0) ? clib_host_to_net_u32 (esp0->seq) : ~0;
 	    }
 	  if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
 	    {
@@ -468,7 +470,9 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      else
 		clib_memcpy (&tr->key4, &key41, sizeof (tr->key4));
 	      tr->is_ip6 = is_ip6;
-	      tr->seq = clib_host_to_net_u32 (esp1->seq);
+	      tr->seq =
+		len1 >=
+		sizeof (*esp1) ? clib_host_to_net_u32 (esp1->seq) : ~0;
 	    }
 	}
 
@@ -641,7 +645,9 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      else
 		clib_memcpy (&tr->key4, &key40, sizeof (tr->key4));
 	      tr->is_ip6 = is_ip6;
-	      tr->seq = clib_host_to_net_u32 (esp0->seq);
+	      tr->seq =
+		len0 >=
+		sizeof (*esp0) ? clib_host_to_net_u32 (esp0->seq) : ~0;
 	    }
 	}