From 378183e21e234f647cb95154d621b261c911856b Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Tue, 1 Oct 2019 08:36:39 -0700
Subject: [PATCH] [tlvs] use uint32_t for TLV size to avoid overflows (#4216)

---
 src/core/common/message.cpp | 6 +++++-
 src/core/common/tlvs.cpp    | 6 +++---
 src/core/common/tlvs.hpp    | 2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/core/common/message.cpp b/src/core/common/message.cpp
index 7ebfef6f8..496aef7f1 100644
--- a/src/core/common/message.cpp
+++ b/src/core/common/message.cpp
@@ -404,7 +404,11 @@ exit:
 
 otError Message::AppendTlv(const Tlv &aTlv)
 {
-    return Append(&aTlv, aTlv.GetSize());
+    uint32_t size = aTlv.GetSize();
+
+    assert(size <= UINT16_MAX);
+
+    return Append(&aTlv, static_cast<uint16_t>(size));
 }
 
 otError Message::Prepend(const void *aBuf, uint16_t aLength)
diff --git a/src/core/common/tlvs.cpp b/src/core/common/tlvs.cpp
index a23bc342d..e136f3da2 100644
--- a/src/core/common/tlvs.cpp
+++ b/src/core/common/tlvs.cpp
@@ -38,7 +38,7 @@
 
 namespace ot {
 
-uint16_t Tlv::GetSize(void) const
+uint32_t Tlv::GetSize(void) const
 {
     return IsExtended() ? sizeof(ExtendedTlv) + static_cast<const ExtendedTlv *>(this)->GetLength()
                         : sizeof(Tlv) + GetLength();
@@ -108,7 +108,7 @@ otError Tlv::Find(const Message &aMessage, uint8_t aType, uint16_t *aOffset, uin
     uint16_t offset       = aMessage.GetOffset();
     uint16_t remainingLen = aMessage.GetLength();
     Tlv      tlv;
-    uint16_t size;
+    uint32_t size;
 
     VerifyOrExit(offset <= remainingLen);
     remainingLen -= offset;
@@ -144,7 +144,7 @@ otError Tlv::Find(const Message &aMessage, uint8_t aType, uint16_t *aOffset, uin
 
             if (aSize != NULL)
             {
-                *aSize = size;
+                *aSize = static_cast<uint16_t>(size);
             }
 
             if (aIsExtendedTlv != NULL)
diff --git a/src/core/common/tlvs.hpp b/src/core/common/tlvs.hpp
index b735bcd10..dc2ba64fa 100644
--- a/src/core/common/tlvs.hpp
+++ b/src/core/common/tlvs.hpp
@@ -120,7 +120,7 @@ public:
      * @returns The total size include Type, Length, and Value fields.
      *
      */
-    uint16_t GetSize(void) const;
+    uint32_t GetSize(void) const;
 
     /**
      * This method returns a pointer to the Value.