From c9bb7685b7ec8e030f8db0dafa6492012b5b46c7 Mon Sep 17 00:00:00 2001
From: Levi Neely <141506390+lneely@users.noreply.github.com>
Date: Tue, 3 Mar 2026 15:49:18 +0100
Subject: [PATCH] Add POVERLAY_BUFSIZE bounds check in prpc.c read loop (#322)

RPC commands tested, sync list works
---
 pclsync/prpc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pclsync/prpc.c b/pclsync/prpc.c
index 6b953fe..1c0cf89 100644
--- a/pclsync/prpc.c
+++ b/pclsync/prpc.c
@@ -86,6 +86,11 @@ static void on_request(void *lpvParam) {
     rqbufp = rqbufp + rc;
     if (readbytes > 12) {
       request = (rpc_message_t *)rqbuf;
+      if (request->length > POVERLAY_BUFSIZE) {
+        pdbg_logf(D_ERROR, "Request length %lu exceeds buffer size %d",
+                  (unsigned long)request->length, POVERLAY_BUFSIZE);
+        goto cleanup;
+      }
       if (request->length == (uint64_t)readbytes)
         break;
     }