espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-31 08:07:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[ip6-mpl] check the length when reading MPL Option (#8672)

Browse Source 
This commit enhances/fixes how we validate an `OptionMpl` we read from
a received message. In `Mpl::ProcessOption()`, we first ensure that
we can read the minimum expected size of an MPL Option and then check
based on the read Control field, the Seed ID length and ensure we can
read the full `OptionMpl` under `kSeedIdLength2`.
This commit is contained in:
Abtin Keshavarzian
2023-01-20 08:30:23 -08:00
committed by GitHub
parent e5383ca9db
commit 30aebb5e74
2 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/net/ip6_mpl.cpp
+14 -5
View File
@@ -79,16 +79,25 @@ Error Mpl::ProcessOption(Message &aMessage, const Address &aAddress, bool aIsOut
Error error;
OptionMpl option;
VerifyOrExit(aMessage.ReadBytes(aMessage.GetOffset(), &option, sizeof(option)) >= OptionMpl::kMinLength &&
(option.GetSeedIdLength() == OptionMpl::kSeedIdLength0 ||
option.GetSeedIdLength() == OptionMpl::kSeedIdLength2),
error = kErrorParse);
// Read the min size bytes first, then check the expected
// `SeedIdLength` and read the full `OptionMpl` if needed.
SuccessOrExit(error = aMessage.Read(aMessage.GetOffset(), &option, OptionMpl::kMinSize));
if (option.GetSeedIdLength() == OptionMpl::kSeedIdLength0)
switch (option.GetSeedIdLength())
{
case OptionMpl::kSeedIdLength0:
// Retrieve Seed ID from the IPv6 Source Address RLOC.
VerifyOrExit(aAddress.GetIid().IsLocator(), error = kErrorDrop);
option.SetSeedId(aAddress.GetIid().GetLocator());
break;
case OptionMpl::kSeedIdLength2:
SuccessOrExit(error = aMessage.Read(aMessage.GetOffset(), option));
break;
case OptionMpl::kSeedIdLength8:
case OptionMpl::kSeedIdLength16:
ExitNow(error = kErrorParse);
}
// Check if the MPL Data Message is new.
src/core/net/ip6_mpl.hpp
+2 -2
View File
@@ -64,8 +64,8 @@ OT_TOOL_PACKED_BEGIN
class OptionMpl : public OptionHeader
{
public:
static constexpr uint8_t kType = 0x6d; // 01 1 01101
static constexpr uint8_t kMinLength = 2;
static constexpr uint8_t kType = 0x6d; ///< MPL option type - 01 1 01101
static constexpr uint8_t kMinSize = (2 + sizeof(OptionHeader)); ///< Minimum size (num of bytes) of `OptionMpl`
/**
* This method initializes the MPL header.