- COTP: fixed possible heap buffer overflow when handling message with invalid (zero) value in length field (#250)

src/mms/iso_cotp/cotp.c

@@ -720,6 +720,9 @@ CotpConnection_readToTpktBuffer(CotpConnection* self)
             goto exit_waiting;
     }
 
+    if (self->packetSize <= bufPos)
+        goto exit_error;
+
     readBytes = readFromSocket(self, buffer + bufPos, self->packetSize - bufPos);
 
     if (readBytes < 0)