diff --git a/CHANGELOG b/CHANGELOG
index 99bfbef0..5ba0c9af 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -17,6 +17,10 @@ FUTURE
 
 HISTORY
 
+  2006-03-03  Christiaan Simons
+  * ipv4/ip_frag.c: Added bound-checking assertions on ip_reassbitmap
+    access and added pbuf_alloc() return value checks.
+
   2006-01-01  Leon Woestenberg <leon.woestenberg@gmx.net>
   * tcp_{in,out}.c, tcp_out.c: Removed 'even sndbuf' fix in TCP, which is
     now handled by the checksum routine properly.
@@ -24,7 +28,7 @@ HISTORY
   2006-02-27  Leon Woestenberg <leon.woestenberg@gmx.net>
    * pbuf.c: Fix alignment; pbuf_init() would not work unless
      pbuf_pool_memory[] was properly aligned. (Patch by Curt McDowell.)
-     
+
   2005-12-20  Leon Woestenberg <leon.woestenberg@gmx.net>
   * tcp.c: Remove PCBs which stay in LAST_ACK state too long. Patch
     submitted by Mitrani Hiroshi.
diff --git a/src/core/ipv4/ip_frag.c b/src/core/ipv4/ip_frag.c
index 038b39d3..5a57138c 100644
--- a/src/core/ipv4/ip_frag.c
+++ b/src/core/ipv4/ip_frag.c
@@ -304,6 +304,9 @@ ip_frag(struct pbuf *p, struct netif *netif, struct ip_addr *dest)
 
   /* Get a RAM based MTU sized pbuf */
   rambuf = pbuf_alloc(PBUF_LINK, 0, PBUF_REF);
+  if (rambuf == NULL) {
+    return ERR_MEM;
+  }
   rambuf->tot_len = rambuf->len = mtu;
   rambuf->payload = MEM_ALIGN((void *)buf);
 
@@ -347,11 +350,15 @@ ip_frag(struct pbuf *p, struct netif *netif, struct ip_addr *dest)
      * worked would make things simpler.
      */
     header = pbuf_alloc(PBUF_LINK, 0, PBUF_RAM);
-    pbuf_chain(header, rambuf);
-    netif->output(netif, header, dest);
-    IPFRAG_STATS_INC(ip_frag.xmit);
-    pbuf_free(header);
-
+    if (header != NULL) {
+      pbuf_chain(header, rambuf);
+      netif->output(netif, header, dest);
+      IPFRAG_STATS_INC(ip_frag.xmit);
+      pbuf_free(header);
+    } else {
+      pbuf_free(rambuf);      
+      return ERR_MEM;    
+    }
     left -= cop;
   }
   pbuf_free(rambuf);