From c8305f618d58c640d620ffce414cdb8669e0e3ce Mon Sep 17 00:00:00 2001
From: tanjunliang <tanjunliang@qiyi.com>
Date: Fri, 9 Nov 2018 09:35:40 +0800
Subject: [PATCH] fixed the crash issue when len is minus caused by invalid
 data.

---
 ikcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ikcp.c b/ikcp.c
index 6d564f7..f3ad4c9 100644
--- a/ikcp.c
+++ b/ikcp.c
@@ -772,7 +772,7 @@ int ikcp_input(ikcpcb *kcp, const char *data, long size)
 
 		size -= IKCP_OVERHEAD;
 
-		if ((long)size < (long)len) return -2;
+		if ((long)size < (long)len || (int)len < 0) return -2;
 
 		if (cmd != IKCP_CMD_PUSH && cmd != IKCP_CMD_ACK &&
 			cmd != IKCP_CMD_WASK && cmd != IKCP_CMD_WINS)