check_icmp: Reject negative ICMP data length

The -b/--size handler checks the lower bound after casting the value to
unsigned long while checking the upper bound as a signed comparison.  A
negative argument such as "-b -65536" therefore satisfies both checks.
The value is then truncated to an undersized icmp_data_size, which later
serves as the size of the ICMP send buffer, so building the packet
overflows that buffer.

Compare the size as a signed long against both bounds so negative values
are rejected.

Reported-by: Christopher Kreft <Email@ChristopherKreft.de>

0 files changed, 0 insertions, 0 deletions