1 files changed, 8 insertions, 3 deletions

diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index 16542dec0f47..3cb8f6bab695 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -302,9 +302,12 @@ tunifioctl(ifp, cmd, data)
 			 ifp->if_name, ifp->if_unit);
 		break;
 	case SIOCSIFMTU:
-		ifp->if_mtu = ifr->ifr_mtu;
-		TUNDEBUG("%s%d: mtu set\n",
-			 ifp->if_name, ifp->if_unit);
+		if (ifr->ifr_mtu < IF_MINMTU || ifr->ifr_mtu > IF_MAXMTU)
+			error = EINVAL;
+		else {
+			ifp->if_mtu = ifr->ifr_mtu;
+			TUNDEBUG("%s%d: mtu set\n", ifp->if_name, ifp->if_unit);
+		}
 		break;
 	case SIOCADDMULTI:
 	case SIOCDELMULTI:
@@ -435,6 +438,8 @@ tunioctl(dev, cmd, data, flag, p)
 	switch (cmd) {
  	case TUNSIFINFO:
  	        tunp = (struct tuninfo *)data;
+		if (tunp->mtu < IF_MINMTU || tunp->mtu > IF_MAXMTU)
+			return (EINVAL);
  		tp->tun_if.if_mtu = tunp->mtu;
  		tp->tun_if.if_type = tunp->type;
  		tp->tun_if.if_baudrate = tunp->baudrate;