From 0193d6ce2edfa59d4ef6921cc6aa33f7c3f64a5a Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Wed, 19 Jul 2017 18:56:02 -0700
Subject: [PATCH] [mac] check frame length before reading security header
 (#2015)

---
 src/core/mac/mac_frame.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/core/mac/mac_frame.cpp b/src/core/mac/mac_frame.cpp
index a276648cd..d58f6cf8f 100644
--- a/src/core/mac/mac_frame.cpp
+++ b/src/core/mac/mac_frame.cpp
@@ -176,11 +176,12 @@ otError Frame::InitMacHeader(uint16_t aFcf, uint8_t aSecurityControl)
 otError Frame::ValidatePsdu(void)
 {
     otError error = OT_ERROR_PARSE;
-    uint8_t offset = 0;
-    uint16_t fcf;
+    uint8_t offset = kFcfSize + kDsnSize;
     uint8_t footerLength = kFcsSize;
+    uint16_t fcf;
+
+    VerifyOrExit((offset + footerLength) <= GetPsduLength());
 
-    VerifyOrExit((offset += kFcfSize + kDsnSize) <= GetPsduLength());
     fcf = static_cast<uint16_t>((GetPsdu()[1] << 8) | GetPsdu()[0]);
 
     // Destinatinon PAN + Address
@@ -229,6 +230,8 @@ otError Frame::ValidatePsdu(void)
         goto exit;
     }
 
+    VerifyOrExit((offset + footerLength) <= GetPsduLength());
+
     // Security Header
     if (fcf & Frame::kFcfSecurityEnabled)
     {