Index: firmware/App/Services/SystemCommMessages.c =================================================================== diff -u -rbb053c804432b4c9dd0ed36f62a47bbfa39fa847 -r51e60f3e3a7c95c910c24dd5f3b58e0c6b2691b8 --- firmware/App/Services/SystemCommMessages.c (.../SystemCommMessages.c) (revision bb053c804432b4c9dd0ed36f62a47bbfa39fa847) +++ firmware/App/Services/SystemCommMessages.c (.../SystemCommMessages.c) (revision 51e60f3e3a7c95c910c24dd5f3b58e0c6b2691b8) @@ -8,7 +8,7 @@ * @file SystemCommMessages.c * * @author (last) Dara Navaei -* @date (last) 05-Jan-2022 +* @date (last) 02-Mar-2022 * * @author (original) Dara Navaei * @date (original) 05-Nov-2019 @@ -3360,16 +3360,19 @@ BOOL status = FALSE; U08* payloadPtr = message->payload; - memcpy(¤tMessage, payloadPtr, sizeof(U32)); - payloadPtr += sizeof(U32); + if ( message->hdr.payloadLen >= ( sizeof(currentMessage) + sizeof(totalMessages) + sizeof(payloadLength) ) ) + { + memcpy(¤tMessage, payloadPtr, sizeof(U32)); + payloadPtr += sizeof(U32); - memcpy(&totalMessages, payloadPtr, sizeof(U32)); - payloadPtr += sizeof(U32); + memcpy(&totalMessages, payloadPtr, sizeof(U32)); + payloadPtr += sizeof(U32); - memcpy(&payloadLength, payloadPtr, sizeof(U32)); - payloadPtr += sizeof(U32); + memcpy(&payloadLength, payloadPtr, sizeof(U32)); + payloadPtr += sizeof(U32); - status = receiveRecordFromDialin( NVDATAMGMT_SW_CONFIG_RECORD, currentMessage, totalMessages, payloadLength, payloadPtr ); + status = receiveRecordFromDialin( NVDATAMGMT_SW_CONFIG_RECORD, currentMessage, totalMessages, payloadLength, payloadPtr ); + } // Respond to request sendTestAckResponseMsg( (MSG_ID_T)message->hdr.msgID, status );