len = GET_BE_U_2(dat) & L2TP_AVP_HDR_LEN_MASK;
/* If it is not long enough to contain the header, we'll give up. */
- ND_LCHECKMSG_U(len, 6, "AVP length");
+ ND_ICHECKMSG_U("AVP length", len, <, 6);
/* If it goes past the end of the remaining length of the packet,
we'll give up. */
if (flag_o) { /* Offset Size */
pad = GET_BE_U_2(ptr);
+ /* Offset padding octets in packet buffer? */
+ ND_TCHECK_LEN(ptr + 2, pad);
ptr += (2 + pad);
cnt += (2 + pad);
}