Merge pull request #20880 from Teufelchen1/fix/lora

gnrc_lorawan: Ensure minimal packet length

sys/net/gnrc/link_layer/lorawan/gnrc_lorawan_mcps.c

@@ -116,6 +116,10 @@ int gnrc_lorawan_parse_dl(gnrc_lorawan_t *mac, uint8_t *buf, size_t len,
         pkt->fopts.iol_base = buf;
         pkt->fopts.iol_len = fopts_length;
         buf += fopts_length;
+        if (buf >= p_mic) {
+            DEBUG("gnrc_lorawan: packet with fopts but no payload. Drop\n");
+            return -1;
+        }
     }
 
     if (buf < p_mic) {
@@ -165,6 +169,11 @@ void gnrc_lorawan_mcps_process_downlink(gnrc_lorawan_t *mac, uint8_t *psdu,
 {
     struct parsed_packet _pkt;
 
+    if (size < sizeof(lorawan_hdr_t) + MIC_SIZE) {
+        DEBUG("gnrc_lorawan: invalid psdu size\n");
+        return;
+    }
+
     /* NOTE: MIC is in pkt */
     if (!gnrc_lorawan_mic_is_valid(psdu, size, mac->ctx.snwksintkey,
                                    mac->mcps.fcnt, gnrc_lorawan_optneg_is_set(mac))) {