From 3580539e0ff6875512b9abd3ec8273efb791a905 Mon Sep 17 00:00:00 2001
From: tanjunliang <tanjunliang@qiyi.com>
Date: Thu, 1 Nov 2018 10:26:54 +0800
Subject: [PATCH] fixed the crash issue when len is minus caused by invalid
 data.

---
 ikcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ikcp.c b/ikcp.c
index ddeb28a..ff28556 100644
--- a/ikcp.c
+++ b/ikcp.c
@@ -772,7 +772,7 @@ int ikcp_input(ikcpcb *kcp, const char *data, long size)
 
 		size -= IKCP_OVERHEAD;
 
-		if ((long)size < (long)len) return -2;
+		if ((long)size < (long)len || (int)len < 0) return -2;
 
 		if (cmd != IKCP_CMD_PUSH && cmd != IKCP_CMD_ACK &&
 			cmd != IKCP_CMD_WASK && cmd != IKCP_CMD_WINS)