tun: freebsd: avoid OOB writes

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/tun/tun_freebsd.go b/tun/tun_freebsd.go
index 37f1a0c..c4c6b64 100644
--- a/tun/tun_freebsd.go
+++ b/tun/tun_freebsd.go
@@ -8,6 +8,7 @@ package tun
 import (
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"os"
 	"sync"
@@ -347,7 +348,13 @@ func (tun *NativeTun) Read(buff []byte, offset int) (int, error) {
 }
 
 func (tun *NativeTun) Write(buf []byte, offset int) (int, error) {
+	if offset < 4 {
+		return 0, io.ErrShortBuffer
+	}
 	buf = buf[offset-4:]
+	if len(buf) < 5 {
+		return 0, io.ErrShortBuffer
+	}
 	buf[0] = 0x00
 	buf[1] = 0x00
 	buf[2] = 0x00