receive length check bugfix

gioblu · Sep 13, 2017 · e1b97e2a0c8456b54f042e9953a1ea4fcf7ebf1a · e1b97e2
1 parent c38a4a0
commit e1b97e2a0c8456b54f042e9953a1ea4fcf7ebf1a
Unified Split

Showing with 8 additions and 2 deletions.

+8 −2 PJON.h
diff --git a/PJON.h b/PJON.h
@@ -427,12 +427,18 @@ class PJON {

        if((i == (2 + extended_header)) && !extended_length) {
          length = data[i];
-          if(length < 5 || length > PJON_PACKET_MAX_LENGTH) return PJON_FAIL;
+          if(
+            length < (overhead + !async_ack) ||
+            length >= PJON_PACKET_MAX_LENGTH
+          ) return PJON_FAIL;
        }

        if((i == (3 + extended_header)) && extended_length) {
          length = (data[i - 1] << 8) | (data[i] & 0xFF);
-          if(length < 5 || length > PJON_PACKET_MAX_LENGTH) return PJON_FAIL;
+          if(
+            length < (overhead + !async_ack) ||
+            length >= PJON_PACKET_MAX_LENGTH
+          ) return PJON_FAIL;
        }

        if((config & PJON_MODE_BIT) && (data[1] & PJON_MODE_BIT) && !_router)