espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-07 19:27:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mac] check frame length before reading security header (#2015)

Browse Source
This commit is contained in:
Jonathan Hui
2017-07-19 18:56:02 -07:00
committed by GitHub
parent fa1041f705
commit 0193d6ce2e
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/mac/mac_frame.cpp
+6 -3
View File
@@ -176,11 +176,12 @@ otError Frame::InitMacHeader(uint16_t aFcf, uint8_t aSecurityControl)
otError Frame::ValidatePsdu(void)
{
otError error = OT_ERROR_PARSE;
uint8_t offset = 0;
uint16_t fcf;
uint8_t offset = kFcfSize + kDsnSize;
uint8_t footerLength = kFcsSize;
uint16_t fcf;
VerifyOrExit((offset + footerLength) <= GetPsduLength());
VerifyOrExit((offset += kFcfSize + kDsnSize) <= GetPsduLength());
fcf = static_cast<uint16_t>((GetPsdu()[1] << 8) | GetPsdu()[0]);
// Destinatinon PAN + Address
@@ -229,6 +230,8 @@ otError Frame::ValidatePsdu(void)
goto exit;
}
VerifyOrExit((offset + footerLength) <= GetPsduLength());
// Security Header
if (fcf & Frame::kFcfSecurityEnabled)
{