Bluetooth: Mesh: add check for rx buffer overflow in pb adv
There is potential buffer overflow in pb adv. If Transaction Continuation PDU comes before Transaction Start PDU the last segment number is set to 0xff. The current implementation has a strictly limited buffer size. It is possible to receive malformed frame with wrong segment number. All segments with number 2 and above will be stored in the memory behind Rx buffer. Signed-off-by:Aleksandr Khromykh <Aleksandr.Khromykh@nordicsemi.no> (cherry picked from commit 6896075b)
Loading
Please sign in to comment