espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-28 22:57:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[network-data] in Validate() only check dups against prior prefixes (#5083)

Browse Source 
To avoid buffer overrrun issues.
This commit is contained in:
Jonathan Hui
2020-06-11 10:25:53 -07:00
committed by GitHub
parent 8e124e6fac
commit 2c258a3f3e
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/thread/network_data_leader_ftd.cpp
+7 -3
View File
@@ -416,8 +416,12 @@ otError Leader::Validate(const uint8_t *aTlvs, uint8_t aTlvsLength, uint16_t aRl
for (const NetworkDataTlv *cur = reinterpret_cast<const NetworkDataTlv *>(aTlvs); cur < end; cur = cur->GetNext())
{
uint8_t offset;
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
offset = static_cast<uint8_t>(reinterpret_cast<const uint8_t *>(cur) - aTlvs);
switch (cur->GetType())
{
case NetworkDataTlv::kTypePrefix:
@@ -427,7 +431,7 @@ otError Leader::Validate(const uint8_t *aTlvs, uint8_t aTlvsLength, uint16_t aRl
VerifyOrExit(prefix->IsValid(), error = OT_ERROR_PARSE);
// Ensure there is no duplicate Prefix TLVs with same prefix.
VerifyOrExit(prefix == FindPrefix(prefix->GetPrefix(), prefix->GetPrefixLength(), aTlvs, aTlvsLength),
VerifyOrExit(FindPrefix(prefix->GetPrefix(), prefix->GetPrefixLength(), aTlvs, offset) == NULL,
error = OT_ERROR_PARSE);
SuccessOrExit(error = ValidatePrefix(*prefix, aRloc16));
@@ -442,8 +446,8 @@ otError Leader::Validate(const uint8_t *aTlvs, uint8_t aTlvsLength, uint16_t aRl
// Ensure there is no duplicate Service TLV with same
// Enterprise Number and Service Data.
VerifyOrExit(service == FindService(service->GetEnterpriseNumber(), service->GetServiceData(),
service->GetServiceDataLength(), aTlvs, aTlvsLength),
VerifyOrExit(FindService(service->GetEnterpriseNumber(), service->GetServiceData(),
service->GetServiceDataLength(), aTlvs, offset) == NULL,
error = OT_ERROR_PARSE);
SuccessOrExit(error = ValidateService(*service, aRloc16));