From 08247dc92fed4c0a8119747f588f2f9a83deb828 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Fri, 28 Dec 2018 17:27:25 -0800 Subject: [PATCH] [message] avoid length overflow in SetLength() (#3418) Credit to OSS-Fuzz. --- src/core/common/message.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/core/common/message.cpp b/src/core/common/message.cpp index ae623bc40..9c402022d 100644 --- a/src/core/common/message.cpp +++ b/src/core/common/message.cpp @@ -331,6 +331,8 @@ otError Message::SetLength(uint16_t aLength) uint16_t totalLengthCurrent = GetReserved() + GetLength(); int bufs = 0; + VerifyOrExit(totalLengthRequest >= GetReserved(), error = OT_ERROR_INVALID_ARGS); + if (totalLengthRequest > kHeadBufferDataSize) { bufs = (((totalLengthRequest - kHeadBufferDataSize) - 1) / kBufferDataSize) + 1;