ncp-spinel: Fix a buffer-overflow bug in the inbound data pump.

openthread · Jun 16, 2016 · 910769e · 910769e
1 parent 5aafbd5
commit 910769e
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/ncp-spinel/SpinelNCPInstance-DataPump.cpp b/src/ncp-spinel/SpinelNCPInstance-DataPump.cpp
@@ -232,6 +232,8 @@ SpinelNCPInstance::ncp_to_driver_pump()
 				mInboundFrameHDLCCRC = hdlc_crc16(mInboundFrameHDLCCRC, mInboundFrame[mInboundFrameSize-2]);
 			}
 
+			require(mInboundFrameSize >= sizeof(mInboundFrame), on_error);
+
 			mInboundFrame[mInboundFrameSize++] = byte;
 
 		} while(true);