From 1fff473335f20c25593ff10f2481ec94c7d4d582 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Mon, 23 Apr 2018 09:14:22 -0700
Subject: [PATCH] [dataset] add message length checks when processing
 MGMT_SET.req (#2671)

Credit to OSS-Fuzz.
---
 src/core/meshcop/dataset_manager_ftd.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/core/meshcop/dataset_manager_ftd.cpp b/src/core/meshcop/dataset_manager_ftd.cpp
index 8eb39b4e1..38d42f676 100644
--- a/src/core/meshcop/dataset_manager_ftd.cpp
+++ b/src/core/meshcop/dataset_manager_ftd.cpp
@@ -266,6 +266,8 @@ otError DatasetManager::Set(Coap::Header &aHeader, Message &aMessage, const Ip6:
             } OT_TOOL_PACKED_END data;
 
             aMessage.Read(offset, sizeof(Tlv), &data.tlv);
+            VerifyOrExit(data.tlv.GetLength() <= sizeof(data.value), state = StateTlv::kReject);
+
             aMessage.Read(offset + sizeof(Tlv), data.tlv.GetLength(), data.value);
 
             switch (data.tlv.GetType())
@@ -291,7 +293,7 @@ otError DatasetManager::Set(Coap::Header &aHeader, Message &aMessage, const Ip6:
                 // fall through
 
             default:
-                dataset.Set(data.tlv);
+                VerifyOrExit(dataset.Set(data.tlv) == OT_ERROR_NONE, state = StateTlv::kReject);
                 break;
             }