From 559b5876edc9e1ad4ba1de2bdc3dbe190bab4608 Mon Sep 17 00:00:00 2001
From: puddly <32534428+puddly@users.noreply.github.com>
Date: Wed, 29 May 2024 21:27:43 -0400
Subject: [PATCH] Fix command parsing for `SET_SOURCE_ROUTE_REQ`

---
 src/ncp-uart-hw/app.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/ncp-uart-hw/app.c b/src/ncp-uart-hw/app.c
index fa203076..d7d06fe8 100644
--- a/src/ncp-uart-hw/app.c
+++ b/src/ncp-uart-hw/app.c
@@ -190,12 +190,12 @@ EmberStatus emberAfPluginXncpIncomingCustomFrameCallback(uint8_t messageLength,
       rsp_command_id = XNCP_CMD_SET_SOURCE_ROUTE_RSP;
       rsp_status = EMBER_SUCCESS;
 
-      if (messageLength % 2 != 0) {
+      if ((messageLength < 2) || (messageLength % 2 != 0)) {
         rsp_status = EMBER_BAD_ARGUMENT;
         break;
       }
 
-      uint8_t num_relays = messageLength / 2;
+      uint8_t num_relays = (messageLength - 2) / 2;
 
       if (num_relays > EMBER_MAX_SOURCE_ROUTE_RELAY_COUNT + 1) {
         rsp_status = EMBER_BAD_ARGUMENT;