From e1b97e2a0c8456b54f042e9953a1ea4fcf7ebf1a Mon Sep 17 00:00:00 2001 From: unknown Date: Wed, 13 Sep 2017 22:31:16 +0200 Subject: [PATCH] receive length check bugfix --- PJON.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/PJON.h b/PJON.h index b1288caa0c..6910d5e393 100644 --- a/PJON.h +++ b/PJON.h @@ -427,12 +427,18 @@ class PJON { if((i == (2 + extended_header)) && !extended_length) { length = data[i]; - if(length < 5 || length > PJON_PACKET_MAX_LENGTH) return PJON_FAIL; + if( + length < (overhead + !async_ack) || + length >= PJON_PACKET_MAX_LENGTH + ) return PJON_FAIL; } if((i == (3 + extended_header)) && extended_length) { length = (data[i - 1] << 8) | (data[i] & 0xFF); - if(length < 5 || length > PJON_PACKET_MAX_LENGTH) return PJON_FAIL; + if( + length < (overhead + !async_ack) || + length >= PJON_PACKET_MAX_LENGTH + ) return PJON_FAIL; } if((config & PJON_MODE_BIT) && (data[1] & PJON_MODE_BIT) && !_router)