From 249bc598748ad08a98b08995698669613594e54b Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Fri, 25 Jan 2019 08:36:06 -0800 Subject: [PATCH] [cli] add length check for "service add" (#3508) --- src/cli/cli.cpp | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/cli/cli.cpp b/src/cli/cli.cpp index 7e816b2b1..6a54f8040 100644 --- a/src/cli/cli.cpp +++ b/src/cli/cli.cpp @@ -1630,19 +1630,26 @@ void Interpreter::ProcessService(int argc, char *argv[]) if (strcmp(argv[0], "add") == 0) { otServiceConfig cfg; - long enterpriseNumber = 0; + long enterpriseNumber; + size_t length; VerifyOrExit(argc > 3, error = OT_ERROR_INVALID_ARGS); SuccessOrExit(error = ParseLong(argv[1], enterpriseNumber)); + cfg.mEnterpriseNumber = static_cast(enterpriseNumber); - cfg.mServiceDataLength = static_cast(strlen(argv[2])); + length = strlen(argv[2]); + VerifyOrExit(length <= sizeof(cfg.mServiceData), error = OT_ERROR_NO_BUFS); + cfg.mServiceDataLength = static_cast(length); memcpy(cfg.mServiceData, argv[2], cfg.mServiceDataLength); - cfg.mEnterpriseNumber = static_cast(enterpriseNumber); - cfg.mServerConfig.mStable = true; - cfg.mServerConfig.mServerDataLength = static_cast(strlen(argv[3])); + + length = strlen(argv[3]); + VerifyOrExit(length <= sizeof(cfg.mServerConfig.mServerData), error = OT_ERROR_NO_BUFS); + cfg.mServerConfig.mServerDataLength = static_cast(length); memcpy(cfg.mServerConfig.mServerData, argv[3], cfg.mServerConfig.mServerDataLength); + cfg.mServerConfig.mStable = true; + SuccessOrExit(error = otServerAddService(mInstance, &cfg)); } else if (strcmp(argv[0], "remove") == 0)