Commit acc7cfaa authored Jul 18, 2023 by Robert Lubos Committed by Chris Friedt Oct 02, 2023

drivers: ieee802154_nrf5: Add payload length check on TX

In case upper layer does not follow the convention, and the net_pkt
provided to the nRF 15.4 driver had a payload larger than the maximum
payload size of an individual 15.4 frame, the driver would end up with
buffer overflow.

Fix this by adding an extra payload_len check before attempting to copy
the payload to the internal buffer.

Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>

parent f9a56bcf

drivers/ieee802154/ieee802154_nrf5.c

+5 −0

Changes for drivers/ieee802154/ieee802154_nrf5.c: 5 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -494,6 +494,11 @@ static int nrf5_tx(const struct device *dev,
		uint8_t *payload = frag->data;
		bool ret = true;

		if (payload_len > NRF5_PSDU_LENGTH) {
		LOG_ERR("Payload too large: %d", payload_len);
		return -EMSGSIZE;
		}

		LOG_DBG("%p (%u)", payload, payload_len);

		nrf5_radio->tx_psdu[0] = payload_len + NRF5_FCS_LENGTH;

Admin message