From 30aebb5e74064d63513ea78dd4fa2ecc46fd38f9 Mon Sep 17 00:00:00 2001
From: Abtin Keshavarzian <abtink@google.com>
Date: Fri, 20 Jan 2023 08:30:23 -0800
Subject: [PATCH] [ip6-mpl] check the length when reading MPL Option (#8672)

This commit enhances/fixes how we validate an `OptionMpl` we read from
a received message. In `Mpl::ProcessOption()`, we first ensure that
we can read the minimum expected size of an MPL Option and then check
based on the read Control field, the Seed ID length and ensure we can
read the full `OptionMpl` under `kSeedIdLength2`.
---
 src/core/net/ip6_mpl.cpp | 19 ++++++++++++++-----
 src/core/net/ip6_mpl.hpp |  4 ++--
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/core/net/ip6_mpl.cpp b/src/core/net/ip6_mpl.cpp
index 96ffff265..05e607109 100644
--- a/src/core/net/ip6_mpl.cpp
+++ b/src/core/net/ip6_mpl.cpp
@@ -79,16 +79,25 @@ Error Mpl::ProcessOption(Message &aMessage, const Address &aAddress, bool aIsOut
     Error     error;
     OptionMpl option;
 
-    VerifyOrExit(aMessage.ReadBytes(aMessage.GetOffset(), &option, sizeof(option)) >= OptionMpl::kMinLength &&
-                     (option.GetSeedIdLength() == OptionMpl::kSeedIdLength0 ||
-                      option.GetSeedIdLength() == OptionMpl::kSeedIdLength2),
-                 error = kErrorParse);
+    // Read the min size bytes first, then check the expected
+    // `SeedIdLength` and read the full `OptionMpl` if needed.
+    SuccessOrExit(error = aMessage.Read(aMessage.GetOffset(), &option, OptionMpl::kMinSize));
 
-    if (option.GetSeedIdLength() == OptionMpl::kSeedIdLength0)
+    switch (option.GetSeedIdLength())
     {
+    case OptionMpl::kSeedIdLength0:
         // Retrieve Seed ID from the IPv6 Source Address RLOC.
         VerifyOrExit(aAddress.GetIid().IsLocator(), error = kErrorDrop);
         option.SetSeedId(aAddress.GetIid().GetLocator());
+        break;
+
+    case OptionMpl::kSeedIdLength2:
+        SuccessOrExit(error = aMessage.Read(aMessage.GetOffset(), option));
+        break;
+
+    case OptionMpl::kSeedIdLength8:
+    case OptionMpl::kSeedIdLength16:
+        ExitNow(error = kErrorParse);
     }
 
     // Check if the MPL Data Message is new.
diff --git a/src/core/net/ip6_mpl.hpp b/src/core/net/ip6_mpl.hpp
index e1fbdf7b6..5688e5f0d 100644
--- a/src/core/net/ip6_mpl.hpp
+++ b/src/core/net/ip6_mpl.hpp
@@ -64,8 +64,8 @@ OT_TOOL_PACKED_BEGIN
 class OptionMpl : public OptionHeader
 {
 public:
-    static constexpr uint8_t kType      = 0x6d; // 01 1 01101
-    static constexpr uint8_t kMinLength = 2;
+    static constexpr uint8_t kType    = 0x6d;                       ///< MPL option type - 01 1 01101
+    static constexpr uint8_t kMinSize = (2 + sizeof(OptionHeader)); ///< Minimum size (num of bytes) of `OptionMpl`
 
     /**
      * This method initializes the MPL header.