Skip to content
Snippets Groups Projects
Commit b4121974 authored by Sebastian Meiling's avatar Sebastian Meiling
Browse files

driver, encx24j600: fix possible buffer overflow

    overflow if len < payload_len, that is packet too big
parent 0150cfc1
Branches
No related tags found
No related merge requests found
......@@ -360,7 +360,13 @@ static int _recv(netdev_t *netdev, void *buf, size_t len, void *info)
/* hdr.frame_len given by device contains 4 bytes checksum */
size_t payload_len = hdr.frame_len - 4;
if (buf) {
if (payload_len > len) {
/* payload exceeds buffer size */
unlock(dev);
return -ENOBUFS;
}
#ifdef MODULE_NETSTATS_L2
netdev->stats.rx_count++;
netdev->stats.rx_bytes += len;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment