This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 8f5afb96603c731df1d6e5e0e1ccf78342486fb3 Author: raiden00pl <[email protected]> AuthorDate: Sat Oct 24 13:34:08 2026 +0200 wireless/ieee802154: check the frame length before copying it to the IOB The MAC character device copied the payload of a frame into the IOB before MCPS-DATA checked its length, so a long payload was written past the end of the IOB. Reject a frame that does not fit the IOB. Assisted-by: Claude Code Signed-off-by: raiden00pl <[email protected]> --- wireless/ieee802154/mac802154_device.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/wireless/ieee802154/mac802154_device.c b/wireless/ieee802154/mac802154_device.c index 55f82f99ce5..314056a733b 100644 --- a/wireless/ieee802154/mac802154_device.c +++ b/wireless/ieee802154/mac802154_device.c @@ -538,6 +538,15 @@ static ssize_t mac802154dev_write(FAR struct file *filep, return ret; } + /* The frame must fit the IOB before it is copied */ + + if (ret + tx->length > IOB_BUFSIZE(iob)) + { + wlerr("ERROR: frame too long: %d\n", ret + tx->length); + iob_free(iob); + return -E2BIG; + } + iob->io_offset = ret; iob->io_len = iob->io_offset;
