From 3a31a5f36802379cbc0679b9ddd8d57bc6e811f3 Mon Sep 17 00:00:00 2001
From: Abtin Keshavarzian <abtink@google.com>
Date: Wed, 10 Aug 2022 10:26:41 -0700
Subject: [PATCH] [mle] add array bound check to avoid overflow in
 `HandleDataRequest()` (#8002)

---
 src/core/thread/mle_router.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp
index 66302aa38..06433ce32 100644
--- a/src/core/thread/mle_router.cpp
+++ b/src/core/thread/mle_router.cpp
@@ -2882,7 +2882,10 @@ void MleRouter::HandleDataRequest(RxInfo &aRxInfo)
         OT_FALL_THROUGH;
 
     case kErrorNotFound:
-        tlvs[numTlvs++] = Tlv::kActiveDataset;
+        if (numTlvs < sizeof(tlvs))
+        {
+            tlvs[numTlvs++] = Tlv::kActiveDataset;
+        }
         break;
 
     default:
@@ -2901,7 +2904,10 @@ void MleRouter::HandleDataRequest(RxInfo &aRxInfo)
         OT_FALL_THROUGH;
 
     case kErrorNotFound:
-        tlvs[numTlvs++] = Tlv::kPendingDataset;
+        if (numTlvs < sizeof(tlvs))
+        {
+            tlvs[numTlvs++] = Tlv::kPendingDataset;
+        }
         break;
 
     default: