From 366461a3a11d771495625a973cb4297032441219 Mon Sep 17 00:00:00 2001 From: Scott Powell Date: Fri, 11 Apr 2025 14:12:09 +1000 Subject: [PATCH] * companion: onRawDataRecv() guard for payload_len too long --- examples/companion_radio/main.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/examples/companion_radio/main.cpp b/examples/companion_radio/main.cpp index 30e492ce..48eafbf2 100644 --- a/examples/companion_radio/main.cpp +++ b/examples/companion_radio/main.cpp @@ -663,6 +663,10 @@ protected: } void onRawDataRecv(mesh::Packet* packet) override { + if (packet->payload_len + 4 > sizeof(out_frame)) { + MESH_DEBUG_PRINTLN("onRawDataRecv(), payload_len too long: %d", packet->payload_len); + return; + } int i = 0; out_frame[i++] = PUSH_CODE_RAW_DATA; out_frame[i++] = (int8_t)(_radio->getLastSNR() * 4);