From 2582d1573de37f23d77ed2b1e491d095c920ccfc Mon Sep 17 00:00:00 2001
From: whitequark <whitequark@whitequark.org>
Date: Sat, 24 Jun 2017 11:23:27 +0000
Subject: [PATCH] Fix a crash printing a malformed TCP packet.

Found via cargo-fuzz.
---
 src/wire/tcp.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/wire/tcp.rs b/src/wire/tcp.rs
index 7cdeb19ea..2f7244b45 100644
--- a/src/wire/tcp.rs
+++ b/src/wire/tcp.rs
@@ -729,6 +729,13 @@ impl<'a, T: AsRef<[u8]> + ?Sized> fmt::Display for Packet<&'a T> {
             try!(write!(f, " urg={}", self.urgent_at()))
         }
         try!(write!(f, " len={}", self.payload().len()));
+
+        let header_len = self.header_len() as usize;
+        if header_len < field::URGENT.end {
+            try!(write!(f, " {}", Error::Truncated));
+            return Ok(())
+        }
+
         let mut options = self.options();
         while options.len() > 0 {
             let (next_options, option) =