From 4db72783c87b4e3905ba7b754577b24e9c1f3c49 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Sat, 26 Aug 2017 23:56:10 -0700
Subject: [PATCH] [mac-frame] read FCF after validating PSDU length (#2141)

---
 src/core/mac/mac_frame.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/core/mac/mac_frame.cpp b/src/core/mac/mac_frame.cpp
index d218bf0df..de41af414 100644
--- a/src/core/mac/mac_frame.cpp
+++ b/src/core/mac/mac_frame.cpp
@@ -794,8 +794,7 @@ otError Frame::SetPayloadLength(uint8_t aLength)
 uint8_t Frame::FindPayloadIndex(void) const
 {
     uint8_t index = 0;
-    uint16_t fcf = GetFrameControlField();
-    uint8_t securityControl;
+    uint16_t fcf;
 
     // Frame Control
     index += kFcfSize;
@@ -804,6 +803,8 @@ uint8_t Frame::FindPayloadIndex(void) const
 
     VerifyOrExit((index + kFcsSize) <= GetPsduLength(), index = kInvalidIndex);
 
+    fcf = GetFrameControlField();
+
     // Destination PAN + Address
     switch (fcf & kFcfDstAddrMask)
     {
@@ -855,7 +856,7 @@ uint8_t Frame::FindPayloadIndex(void) const
     // Security Control + Frame Counter + Key Identifier
     if ((fcf & kFcfSecurityEnabled) != 0)
     {
-        securityControl = *(GetPsdu() + index);
+        uint8_t securityControl = *(GetPsdu() + index);
 
         index += kSecurityControlSize + kFrameCounterSize;