espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-21 18:09:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add bounds checks. (#1077)

Browse Source
This commit is contained in:
Jonathan Hui
2016-12-15 08:44:15 -08:00
committed by GitHub
parent 2f83522c8b
commit 1350160817
3 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/meshcop/commissioner.cpp
+1
View File
@@ -688,6 +688,7 @@ void Commissioner::HandleRelayReceive(Coap::Header &aHeader, Message &aMessage,
VerifyOrExit(joinerRloc.IsValid(), error = kThreadError_Parse);
SuccessOrExit(error = Tlv::GetValueOffset(aMessage, Tlv::kJoinerDtlsEncapsulation, offset, length));
VerifyOrExit(length <= aMessage.GetLength() - offset, error = kThreadError_Parse);
if (!mSecureCoapServer.IsConnectionActive())
{
src/core/net/dhcp6_client.cpp
+2 -1
View File
@@ -618,8 +618,9 @@ ThreadError Dhcp6Client::ProcessIaNa(Message &aMessage, uint16_t aOffset)
VerifyOrExit(aMessage.Read(aOffset, sizeof(option), &option) == sizeof(option), error = kThreadError_Parse);
aOffset += sizeof(option);
length = option.GetLength() - (sizeof(option) - sizeof(Dhcp6Option));
length = option.GetLength();
VerifyOrExit(length <= aMessage.GetLength() - aOffset, error = kThreadError_Parse);
if ((optionOffset = FindOption(aMessage, aOffset, length, kOptionStatusCode)) > 0)
{
src/core/net/dhcp6_server.cpp
+2
View File
@@ -360,6 +360,8 @@ ThreadError Dhcp6Server::ProcessIaNa(Message &aMessage, uint16_t aOffset, IaNa &
aOffset += sizeof(aIaNa);
length = aIaNa.GetLength() + sizeof(Dhcp6Option) - sizeof(IaNa);
VerifyOrExit(length <= aMessage.GetLength() - aOffset, error = kThreadError_Parse);
mPrefixAgentsMask = 0;
while (length > 0)