- /* do not attempt to verify the checksum if it is zero */
- if (!checksum || checksum_offset > length) {
+ /* do not attempt to verify the checksum if it is zero,
+ * if the total length is nonsense,
+ * if the offset is nonsense,
+ * or the base pointer is not sane
+ */
+ if (!checksum
+ || length > ndo->ndo_snaplen
+ || checksum_offset > ndo->ndo_snaplen
+ || checksum_offset > length) {