From d5f74e93c530a41a2c88dbcc5f34f06860129179 Mon Sep 17 00:00:00 2001
From: Scott Powell <ripple_biz@protonmail.com>
Date: Sat, 13 Jun 2026 18:19:41 +1000
Subject: [PATCH] * PAYLOAD_TYPE_PATH bad path_len now rejected

---
 src/Mesh.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/Mesh.cpp b/src/Mesh.cpp
index 87ad61af2..e9b92262c 100644
--- a/src/Mesh.cpp
+++ b/src/Mesh.cpp
@@ -155,6 +155,10 @@ DispatcherAction Mesh::onRecvPacket(Packet* pkt) {
               if (pkt->getPayloadType() == PAYLOAD_TYPE_PATH) {
                 int k = 0;
                 uint8_t path_len = data[k++];
+                if (!Packet::isValidPathLen(path_len)) {
+                  MESH_DEBUG_PRINTLN("%s PAYLOAD_TYPE_PATH, bad path_len: %u", getLogDateTime(), (uint32_t)path_len);
+                  break;   // reject bad encoding
+                }
                 uint8_t hash_size = (path_len >> 6) + 1;
                 uint8_t hash_count = path_len & 63;
                 uint8_t* path = &data[k]; k += hash_size*hash_count;