From 13501608176cab42c14811e228248762a33feaf5 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Thu, 15 Dec 2016 08:44:15 -0800 Subject: [PATCH] Add bounds checks. (#1077) --- src/core/meshcop/commissioner.cpp | 1 + src/core/net/dhcp6_client.cpp | 3 ++- src/core/net/dhcp6_server.cpp | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/core/meshcop/commissioner.cpp b/src/core/meshcop/commissioner.cpp index 5616b16d5..68cf79fe4 100644 --- a/src/core/meshcop/commissioner.cpp +++ b/src/core/meshcop/commissioner.cpp @@ -688,6 +688,7 @@ void Commissioner::HandleRelayReceive(Coap::Header &aHeader, Message &aMessage, VerifyOrExit(joinerRloc.IsValid(), error = kThreadError_Parse); SuccessOrExit(error = Tlv::GetValueOffset(aMessage, Tlv::kJoinerDtlsEncapsulation, offset, length)); + VerifyOrExit(length <= aMessage.GetLength() - offset, error = kThreadError_Parse); if (!mSecureCoapServer.IsConnectionActive()) { diff --git a/src/core/net/dhcp6_client.cpp b/src/core/net/dhcp6_client.cpp index 9d42ae7c2..a41b48125 100644 --- a/src/core/net/dhcp6_client.cpp +++ b/src/core/net/dhcp6_client.cpp @@ -618,8 +618,9 @@ ThreadError Dhcp6Client::ProcessIaNa(Message &aMessage, uint16_t aOffset) VerifyOrExit(aMessage.Read(aOffset, sizeof(option), &option) == sizeof(option), error = kThreadError_Parse); aOffset += sizeof(option); + length = option.GetLength() - (sizeof(option) - sizeof(Dhcp6Option)); - length = option.GetLength(); + VerifyOrExit(length <= aMessage.GetLength() - aOffset, error = kThreadError_Parse); if ((optionOffset = FindOption(aMessage, aOffset, length, kOptionStatusCode)) > 0) { diff --git a/src/core/net/dhcp6_server.cpp b/src/core/net/dhcp6_server.cpp index 5d03b7bf9..b0d8b0f6f 100644 --- a/src/core/net/dhcp6_server.cpp +++ b/src/core/net/dhcp6_server.cpp @@ -360,6 +360,8 @@ ThreadError Dhcp6Server::ProcessIaNa(Message &aMessage, uint16_t aOffset, IaNa & aOffset += sizeof(aIaNa); length = aIaNa.GetLength() + sizeof(Dhcp6Option) - sizeof(IaNa); + VerifyOrExit(length <= aMessage.GetLength() - aOffset, error = kThreadError_Parse); + mPrefixAgentsMask = 0; while (length > 0)