diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c index d818caabd4..a6a351354b 100644 --- a/src/app-layer-dnp3.c +++ b/src/app-layer-dnp3.c @@ -1034,6 +1034,13 @@ static void DNP3HandleUserDataResponse(DNP3State *dnp3, const uint8_t *input, DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_MALFORMED); return; } + // a data link frame has its size on one byte, + // and transport layer has sequence in 0-63 + if (tx->buffer_len > 63 * 0xff) { + DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_TOO_LONG_REASS); + tx->done = 1; + return; + } if (!DNP3_TH_FIN(th)) { return;