drivers/slipdev: fix off-by-one error in _recv()

drivers/slipdev/slipdev.c

@@ -162,52 +162,46 @@ static int _send(netdev_t *netdev, const iolist_t *iolist)
     return bytes;
 }
 
+static void _drop_frame(slipdev_t *dev)
+{
+    int byte;
+    do {
+        byte = tsrb_get_one(&dev->inbuf);
+    } while (byte > 0 && byte != SLIPDEV_END);
+}
+
 static int _recv(netdev_t *netdev, void *buf, size_t len, void *info)
 {
     slipdev_t *dev = (slipdev_t *)netdev;
     int res = 0;
 
     (void)info;
     if (buf == NULL) {
-        if (len > 0) {
-            /* remove data */
-            for (; len > 0; len--) {
-                int byte = tsrb_get_one(&dev->inbuf);
-                if ((byte == (int)SLIPDEV_END) || (byte < 0)) {
-                    /* end early if end of packet or ringbuffer is reached;
-                     * len might be larger than the actual packet */
-                    break;
-                }
-            }
-        } else {
-            /* the user was warned not to use a buffer size > `INT_MAX` ;-) */
-            res = (int)tsrb_avail(&dev->inbuf);
-        }
+        return (int)tsrb_avail(&dev->inbuf);
     }
-    else {
-        int byte;
-        bool escaped = false;
-        uint8_t *ptr = buf;
 
-        do {
-            int tmp;
+    int byte = 0;
+    bool escaped = false;
+    uint8_t *ptr = buf;
+
+    do {
+        int tmp;
+
+        if ((unsigned)res == len) {
+            /* clear out unreceived packet */
+            _drop_frame(dev);
+            return -ENOBUFS;
+        }
+
+        if ((byte = tsrb_get_one(&dev->inbuf)) < 0) {
+            /* something went wrong, return error */
+            return -EIO;
+        }
+        tmp = slipdev_unstuff_readbyte(ptr, byte, &escaped);
+        ptr += tmp;
+        res += tmp;
+    } while (byte != SLIPDEV_END);
 
-            if ((byte = tsrb_get_one(&dev->inbuf)) < 0) {
-                /* something went wrong, return error */
-                return -EIO;
-            }
-            tmp = slipdev_unstuff_readbyte(ptr, byte, &escaped);
-            ptr += tmp;
-            res += tmp;
-            if ((unsigned)res > len) {
-                while (byte != SLIPDEV_END) {
-                    /* clear out unreceived packet */
-                    byte = tsrb_get_one(&dev->inbuf);
-                }
-                return -ENOBUFS;
-            }
-        } while (byte != SLIPDEV_END);
-    }
     return res;
 }