From 44dcef6d6ee2bc587727cc124b71dab5975ebd6a Mon Sep 17 00:00:00 2001
From: Szymon Janc <szymon.janc@codecoup.pl>
Date: Thu, 14 May 2026 09:01:13 +0200
Subject: [PATCH] nimble/mesh: Check buffer space before relaying proxy message

Check if there is enough space left in message buffer before appending.
This prevents passing broken messages to higher layer.
---
 nimble/host/mesh/src/proxy_msg.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nimble/host/mesh/src/proxy_msg.c b/nimble/host/mesh/src/proxy_msg.c
index 44613af16..aacb258e9 100644
--- a/nimble/host/mesh/src/proxy_msg.c
+++ b/nimble/host/mesh/src/proxy_msg.c
@@ -71,6 +71,11 @@ int bt_mesh_proxy_msg_recv(struct bt_mesh_proxy_role *role,
 {
 	const uint8_t *data = buf;
 
+	if (net_buf_simple_tailroom(role->buf) < len - 1) {
+		BT_WARN("Proxy role buffer overflow");
+		return -EINVAL;
+	}
+
 	switch (PDU_SAR(data)) {
 	case SAR_COMPLETE:
 		if (role->buf->om_len) {