diff --git a/Packet++/src/BgpLayer.cpp b/Packet++/src/BgpLayer.cpp index 4e1269abc..b32ab8d01 100644 --- a/Packet++/src/BgpLayer.cpp +++ b/Packet++/src/BgpLayer.cpp @@ -542,6 +542,11 @@ namespace pcpp if (headerLen >= minLen) { size_t withdrawnRouteLen = getWithdrawnRoutesLength(); + // Ensure the memory access is within bounds + if (sizeof(bgp_common_header) + sizeof(uint16_t) + withdrawnRouteLen + sizeof(uint16_t) > headerLen) + { + return 0; // Invalid access, return 0 + } uint16_t res = be16toh(*(uint16_t*)(m_Data + sizeof(bgp_common_header) + sizeof(uint16_t) + withdrawnRouteLen)); if ((size_t)res > headerLen - minLen - withdrawnRouteLen)