From 4bf5ccd397b907bff4660bf418e82132a45fdd34 Mon Sep 17 00:00:00 2001
From: liquidraver <504870+liquidraver@users.noreply.github.com>
Date: Mon, 21 Sep 2026 10:06:59 +0200
Subject: [PATCH] length guards for dispatcher

---
 .gitignore                  | 8 ++++++++
 zephcore/src/Dispatcher.cpp | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/.gitignore b/.gitignore
index 298f325..b001d24 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,14 @@ build-*/
 **/build-*/
 **/build_*/
 /twister-out*/
+/build-tests/
+/test-results/
+/tests/lab.local.yaml
+
+# Regression suite stays local until it is ready to publish.
+/tests/
+/.github/workflows/tests.yml
+/docs/REGRESSION_TEST_PLAN.md
 
 # West workspace (recreated by west init/update)
 /.west/
diff --git a/zephcore/src/Dispatcher.cpp b/zephcore/src/Dispatcher.cpp
index 6650f62..c97adbb 100644
--- a/zephcore/src/Dispatcher.cpp
+++ b/zephcore/src/Dispatcher.cpp
@@ -260,6 +260,9 @@ uint32_t Dispatcher::msUntilNextMaintenance()
 
 bool Dispatcher::tryParsePacket(Packet *pkt, const uint8_t *raw, int len)
 {
+	/* Check the received extent before reading header/path fields.  The radio
+	 * buffer may be larger than len, but bytes outside len are not packet data. */
+	if (len < 2 || len > MAX_TRANS_UNIT) return false;
 	int i = 0;
 
 	pkt->header = raw[i++];
@@ -269,6 +272,7 @@ bool Dispatcher::tryParsePacket(Packet *pkt, const uint8_t *raw, int len)
 	}
 
 	if (pkt->hasTransportCodes()) {
+		if (len < 6) return false; /* header + two codes + path length */
 		memcpy(&pkt->transport_codes[0], &raw[i], 2); i += 2;
 		memcpy(&pkt->transport_codes[1], &raw[i], 2); i += 2;
 	} else {