Fixed a bug in --data-length parsing. User input was not being checked and in some cases that resulted in useless buffer allocations and unpredictable payload lengths. Check http://seclists.org/nmap-dev/2009/q2/0763.html for a complete description of the problem.

nmap.h

@@ -399,6 +399,10 @@ void *realloc();
 #define MAXHOSTNAMELEN 64
 #endif
 
+/* Max payload: Worst case is IPv4 with 40bytes of options and TCP with 20
+ * bytes of options. */
+#define MAX_PAYLOAD_ALLOWED 65535-60-40
+
 #ifndef recvfrom6_t
 #  define recvfrom6_t int
 #endif