--- v2.0.31/linux/net/ipv4/ip_fragment.c        Tue Aug 12 11:30:25 1997
+++ linux/net/ipv4/ip_fragment.c        Thu Nov 13 05:58:30 1997
@@ -375,7 +375,7 @@
        fp = qp->fragments;
        while(fp != NULL)
        {
-               if(count+fp->len > skb->len)
+               if (fp->len < 0 || count+fp->len > skb->len)
                {
                        NETDEBUG(printk("Invalid fragment list: Fragment over size.\n"));
                        ip_free(qp);