From e97975afd1e051d77acd870b4f0736b7aac5f60d Mon Sep 17 00:00:00 2001
From: Marcel Holtmann <marcel@holtmann.org>
Date: Tue, 20 Oct 2015 22:07:19 +0200
Subject: [PATCH] monitor: Check length when decoding extended LMP opcodes

---
 monitor/lmp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/monitor/lmp.c b/monitor/lmp.c
index d246776a1..e7e6b25fc 100644
--- a/monitor/lmp.c
+++ b/monitor/lmp.c
@@ -852,6 +852,11 @@ void lmp_packet(const void *data, uint8_t size, bool padded)
 
 	switch (opcode) {
 	case 127:
+		if (size < 2) {
+			print_text(COLOR_ERROR, "extended opcode too short");
+			packet_hexdump(data, size);
+			return;
+		}
 		opcode = LMP_ESC4(((const uint8_t *) data)[1]);
 		off = 2;
 		break;
-- 
2.47.3