From 4b1bc7dc70df6545d75eb678e83abb95700066fb Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Mon, 7 Nov 2016 21:46:44 -0800
Subject: [PATCH] Fix MAC security header processing and validation. (#936)

---
 src/core/mac/mac_frame.cpp | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/core/mac/mac_frame.cpp b/src/core/mac/mac_frame.cpp
index 30ea42ece..e42d8e0e3 100644
--- a/src/core/mac/mac_frame.cpp
+++ b/src/core/mac/mac_frame.cpp
@@ -204,9 +204,10 @@ ThreadError Frame::ValidatePsdu(void)
     // Security Header
     if (fcf & Frame::kFcfSecurityEnabled)
     {
-        VerifyOrExit(offset <= GetPsduLength(),);
         uint8_t secControl = GetPsdu()[offset];
 
+        offset += kSecurityControlSize + kFrameCounterSize;
+
         switch (secControl & kKeyIdModeMask)
         {
         case kKeyIdMode0:
@@ -974,10 +975,7 @@ uint8_t *Frame::GetPayload(void)
     {
         securityControl = *cur;
 
-        if (securityControl & kSecLevelMask)
-        {
-            cur += kSecurityControlSize + kFrameCounterSize;
-        }
+        cur += kSecurityControlSize + kFrameCounterSize;
 
         switch (securityControl & kKeyIdModeMask)
         {