1 files changed, 5 insertions, 0 deletions
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index db36b65249..1c620763d8 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -2150,6 +2150,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
         {
             DPRINTF("+++ C+ mode offloaded task checksum\n");
 
+            /* Large enough for Ethernet and IP headers? */
+            if (saved_size < ETH_HLEN + sizeof(ip_header)) {
+                goto skip_offload;
+            }
+
             /* ip packet header */
             ip_header *ip = NULL;
             int hlen = 0;