From 9150a49c6f7d45ce82eeee0ff850f9d060de6eac Mon Sep 17 00:00:00 2001 From: Matthew Wolter Date: Sat, 11 Apr 2026 20:24:06 -0700 Subject: [PATCH] =?UTF-8?q?G4:=20M06=20=E2=80=94=20add=20return=20after=20?= =?UTF-8?q?oversize-frame=20state=20reset?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: When handle_rx detects an oversize frame header (>300 bytes), it resets state (header, inframe, frame_expected_size) and re-calls itself on any remaining data. But when data is empty after the header, the method fell through to the frame-assembly code with inframe=b"", eventually dispatching an empty frame to reader.handle_rx. Currently absorbed by F06's umbrella try/except, but a guaranteed crash if that guard moves. Adding a bare return after the reset block prevents the fallthrough in both TCP and serial transports. Refs: Forensics report finding M06 --- src/meshcore/serial_cx.py | 2 +- src/meshcore/tcp_cx.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/meshcore/serial_cx.py b/src/meshcore/serial_cx.py index fa7b1a2..ced0130 100644 --- a/src/meshcore/serial_cx.py +++ b/src/meshcore/serial_cx.py @@ -106,7 +106,7 @@ class SerialConnection: self.frame_expected_size = 0 if len(data) > 0: # rerun handle_rx on remaining data self.handle_rx(data) - return + return # nothing left to process after reset upbound = self.frame_expected_size - len(self.inframe) if len(data) < upbound: diff --git a/src/meshcore/tcp_cx.py b/src/meshcore/tcp_cx.py index 2a66b7f..cce0a6b 100644 --- a/src/meshcore/tcp_cx.py +++ b/src/meshcore/tcp_cx.py @@ -96,7 +96,7 @@ class TCPConnection: self.frame_expected_size = 0 if len(data) > 0: # rerun handle_rx on remaining data self.handle_rx(data) - return + return # nothing left to process after reset upbound = self.frame_expected_size - len(self.inframe) if len(data) < upbound :