Fixed potential buffer overflow in ProcessRadioRxDone

SWW13 · mluis1 · commit e851b079c82b · 2022-10-04T09:30:58.000+02:00
diff --git a/src/mac/LoRaMac.c b/src/mac/LoRaMac.c
@@ -938,6 +938,14 @@ static void ProcessRadioRxDone( void )
         }
     }
 
+    // Abort on empty radio frames
+    if( size == 0 )
+    {
+        MacCtx.McpsIndication.Status = LORAMAC_EVENT_INFO_STATUS_ERROR;
+        PrepareRxDoneAbort( );
+        return;
+    }
+
     macHdr.Value = payload[pktHeaderLen++];
 
     // Accept frames of LoRaWAN Major Version 1 only

Original file line number	Diff line number	Diff line change
`@@ -938,6 +938,14 @@ static void ProcessRadioRxDone( void )`
`938`	`938`	`}`
`939`	`939`	`}`
`940`	`940`
	`941`	`+ // Abort on empty radio frames`
	`942`	`+ if( size == 0 )`
	`943`	`+ {`
	`944`	`+ MacCtx.McpsIndication.Status = LORAMAC_EVENT_INFO_STATUS_ERROR;`
	`945`	`+ PrepareRxDoneAbort( );`
	`946`	`+ return;`
	`947`	`+ }`
	`948`	`+`
`941`	`949`	`macHdr.Value = payload[pktHeaderLen++];`
`942`	`950`
`943`	`951`	`// Accept frames of LoRaWAN Major Version 1 only`