From 277817b8d1ec50d123a30be01272d98e4143001b Mon Sep 17 00:00:00 2001
From: DatanoiseTV <6614616+DatanoiseTV@users.noreply.github.com>
Date: Fri, 8 May 2026 21:33:08 +0200
Subject: [PATCH] radio: drop oversized RX packets instead of asserting

handleReceiveInterrupt bounded the encrypted-payload memcpy with an
assert, which a future modem with a longer max payload would turn into
a panic-reset on a malformed (or simply larger) air packet. Replace
with a runtime length check that releases the pool entry, bumps rxBad,
and returns. assert() also vanishes in NDEBUG builds, so there was no
actual bound check in release.
---
 src/mesh/RadioLibInterface.cpp | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/mesh/RadioLibInterface.cpp b/src/mesh/RadioLibInterface.cpp
index de468cf9793..971530c5742 100644
--- a/src/mesh/RadioLibInterface.cpp
+++ b/src/mesh/RadioLibInterface.cpp
@@ -530,7 +530,16 @@ void RadioLibInterface::handleReceiveInterrupt()
 
             mp->which_payload_variant =
                 meshtastic_MeshPacket_encrypted_tag; // Mark that the payload is still encrypted at this point
-            assert(((uint32_t)payloadLen) <= sizeof(mp->encrypted.bytes));
+            if ((uint32_t)payloadLen > sizeof(mp->encrypted.bytes)) {
+                LOG_WARN("Drop oversized RX packet (%d > %u)", payloadLen, (unsigned)sizeof(mp->encrypted.bytes));
+                packetPool.release(mp);
+                // The outer else branch already incremented rxGood for this packet;
+                // undo that and reclassify as rxBad so num_packets_rx isn't double-counted.
+                rxGood--;
+                rxBad++;
+                airTime->logAirtime(RX_ALL_LOG, rxMsec);
+                return;
+            }
             memcpy(mp->encrypted.bytes, radioBuffer.payload, payloadLen);
             mp->encrypted.size = payloadLen;