From 167d616bc2eefe9e4712da5a65681502de5851c0 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Wed, 19 Feb 2020 14:55:20 -0800
Subject: [PATCH] [network-data] avoid buffer overflow in
 HandleCommissioningSet() (#4583)

Reject Commissioner Dataset TLVs with extended TLV length.
---
 src/core/thread/network_data_leader_ftd.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/thread/network_data_leader_ftd.cpp b/src/core/thread/network_data_leader_ftd.cpp
index c9886627d..a3eb2aff3 100644
--- a/src/core/thread/network_data_leader_ftd.cpp
+++ b/src/core/thread/network_data_leader_ftd.cpp
@@ -206,7 +206,7 @@ void Leader::HandleCommissioningSet(Coap::Message &aMessage, const Ip6::MessageI
     {
         MeshCoP::Tlv::Type type;
 
-        VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
+        VerifyOrExit(((cur + 1) <= end) && !cur->IsExtended() && (cur->GetNext() <= end));
 
         type = cur->GetType();