length guards for dispatcher

.gitignore

@@ -6,6 +6,14 @@ build-*/
 **/build-*/
 **/build_*/
 /twister-out*/
+/build-tests/
+/test-results/
+/tests/lab.local.yaml
+
+# Regression suite stays local until it is ready to publish.
+/tests/
+/.github/workflows/tests.yml
+/docs/REGRESSION_TEST_PLAN.md
 
 # West workspace (recreated by west init/update)
 /.west/

zephcore/src/Dispatcher.cpp

@@ -260,6 +260,9 @@ uint32_t Dispatcher::msUntilNextMaintenance()
 
 bool Dispatcher::tryParsePacket(Packet *pkt, const uint8_t *raw, int len)
 {
+	/* Check the received extent before reading header/path fields.  The radio
+	 * buffer may be larger than len, but bytes outside len are not packet data. */
+	if (len < 2 || len > MAX_TRANS_UNIT) return false;
 	int i = 0;
 
 	pkt->header = raw[i++];
@@ -269,6 +272,7 @@ bool Dispatcher::tryParsePacket(Packet *pkt, const uint8_t *raw, int len)
 	}
 
 	if (pkt->hasTransportCodes()) {
+		if (len < 6) return false; /* header + two codes + path length */
 		memcpy(&pkt->transport_codes[0], &raw[i], 2); i += 2;
 		memcpy(&pkt->transport_codes[1], &raw[i], 2); i += 2;
 	} else {