Index: sys/dev/usb/if_ure.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/if_ure.c,v
retrieving revision 1.40
diff -p -u -r1.40 if_ure.c
--- sys/dev/usb/if_ure.c	27 Mar 2020 18:04:45 -0000	1.40
+++ sys/dev/usb/if_ure.c	25 Aug 2020 22:35:10 -0000
@@ -1003,6 +1003,11 @@ ure_uno_rx_loop(struct usbnet *un, struc
 
 		pkt_len = le32toh(rxhdr.ure_pktlen) & URE_RXPKT_LEN_MASK;
 		DPRINTFN(4, ("next packet is %d bytes\n", pkt_len));
+		if (pkt_len > URE_MAX_FRAMELEN) {
+			DPRINTF(("too large packet\n"));
+			if_statinc(ifp, if_ierrors);
+			return;
+		}
 		if (pkt_len > total_len) {
 			DPRINTF(("not enough bytes left for next packet\n"));
 			if_statinc(ifp, if_ierrors);