From aa34a305ee66dc8eb24458bfba6cb884b5b2a972 Mon Sep 17 00:00:00 2001 From: Diebbo Date: Sat, 7 Dec 2024 22:57:07 +0100 Subject: [PATCH] FIX: Integer underflow in pico_socket_fionread --- stack/pico_socket.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/stack/pico_socket.c b/stack/pico_socket.c index 7c73b90f..af5303fe 100644 --- a/stack/pico_socket.c +++ b/stack/pico_socket.c @@ -1616,7 +1616,10 @@ int pico_socket_fionread(struct pico_socket *s) return 0; if(!f->payload_len) { f->payload = f->transport_hdr + sizeof(struct pico_udp_hdr); - f->payload_len = (uint16_t)(f->transport_len - sizeof(struct pico_udp_hdr)); + f->payload_len = + f->transport_len > sizeof(struct pico_udp_hdr)) ? + (uint16_t)(f->transport_len - sizeof(struct pico_udp_hdr)): + 0; } return f->payload_len; } @@ -1630,7 +1633,10 @@ int pico_socket_fionread(struct pico_socket *s) f->payload = f->net_hdr + f->net_len; f->payload_len = (uint16_t)(f->len); if (!s4->hdr_included) - f->payload_len = (uint16_t)(f->payload_len - PICO_SIZE_IP4HDR); + f->payload_len = + f->payload_len > PICO_SIZE_IP4HDR ? + (uint16_t)(f->payload_len - PICO_SIZE_IP4HDR) : + 0; } return f->payload_len; }