From 269b3c97c23ac14bfcacfb8d83a83501ffd277de Mon Sep 17 00:00:00 2001
From: Benjamin Valentin <benpicco@beuth-hochschule.de>
Date: Mon, 31 Oct 2022 22:54:33 +0100
Subject: [PATCH] drivers/slipdev: fix off-by-one error in _recv()

---
 drivers/slipdev/slipdev.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/slipdev/slipdev.c b/drivers/slipdev/slipdev.c
index 1823d54d17..8a042cc155 100644
--- a/drivers/slipdev/slipdev.c
+++ b/drivers/slipdev/slipdev.c
@@ -201,16 +201,19 @@ static int _recv(netdev_t *netdev, void *buf, size_t len, void *info)
                 /* something went wrong, return error */
                 return -EIO;
             }
-            tmp = slipdev_unstuff_readbyte(ptr, byte, &escaped);
-            ptr += tmp;
-            res += tmp;
-            if ((unsigned)res > len) {
+
+            /* frame is larger than expected - lost end marker */
+            if ((unsigned)res >= len) {
                 while (byte != SLIPDEV_END) {
                     /* clear out unreceived packet */
                     byte = tsrb_get_one(&dev->inbuf);
                 }
                 return -ENOBUFS;
             }
+
+            tmp = slipdev_unstuff_readbyte(ptr, byte, &escaped);
+            ptr += tmp;
+            res += tmp;
         } while (byte != SLIPDEV_END);
 
         if (++dev->rx_done != dev->rx_queued) {