Bluetooth: Mesh: add check for rx buffer overflow in pb adv
There is potential buffer overflow in pb adv.
If Transaction Continuation PDU comes before
Transaction Start PDU the last segment number is set to 0xff.
The current implementation has a strictly limited buffer size.
It is possible to receive malformed frame with wrong segment
number. All segments with number 2 and above will be stored
in the memory behind Rx buffer.
Signed-off-by:
Aleksandr Khromykh <Aleksandr.Khromykh@nordicsemi.no>
Loading
Please sign in to comment