From 5ebf8ef9cf1a0df28118c47460277857e0e675b2 Mon Sep 17 00:00:00 2001
From: Holger Adams <mail@holad.de>
Date: Sat, 22 Aug 2026 07:43:38 +0200
Subject: [PATCH] Mesh: reject PATH payload whose path_len claims more path
 bytes than the frame actually contains

---
 src/Mesh.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/Mesh.cpp b/src/Mesh.cpp
index c11f37cacf..ddabc6c09e 100644
--- a/src/Mesh.cpp
+++ b/src/Mesh.cpp
@@ -167,6 +167,10 @@ DispatcherAction Mesh::onRecvPacket(Packet* pkt) {
                 uint8_t hash_size = (path_len >> 6) + 1;
                 uint8_t hash_count = path_len & 63;
                 uint8_t* path = &data[k]; k += hash_size*hash_count;
+                if (k >= len) {
+                  MESH_DEBUG_PRINTLN("%s PAYLOAD_TYPE_PATH, set path_len %u exceeds amount of available payload %u", 
+                    getLogDateTime(), (uint32_t)path_len, (uint32_t)len);
+                }
                 uint8_t extra_type = data[k++] & 0x0F;   // upper 4 bits reserved for future use
                 uint8_t* extra = &data[k];
                 uint8_t extra_len = len - k;   // remainder of packet (may be padded with zeroes!)