diff --git a/subsys/bluetooth/mesh/pb_adv.c b/subsys/bluetooth/mesh/pb_adv.c index 015df3e96e8..b7df81c1fa3 100644 --- a/subsys/bluetooth/mesh/pb_adv.c +++ b/subsys/bluetooth/mesh/pb_adv.c @@ -149,7 +149,7 @@ static struct bt_mesh_send_cb buf_sent_cb = { .end = buf_sent, }; -static uint8_t last_seg(uint8_t len) +static uint8_t last_seg(uint16_t len) { if (len <= START_PAYLOAD_MAX) { return 0; @@ -482,6 +482,13 @@ static void gen_prov_start(struct prov_rx *rx, struct net_buf_simple *buf) return; } + if (START_LAST_SEG(rx->gpc) != last_seg(link.rx.buf->len)) { + BT_ERR("Invalid SegN (%u, calculated %u)", START_LAST_SEG(rx->gpc), + last_seg(link.rx.buf->len)); + prov_failed(PROV_ERR_NVAL_FMT); + return; + } + prov_clear_tx(); link.rx.last_seg = START_LAST_SEG(rx->gpc);