From 444d2e4c84c6545cd3a90d8911cbf8899264eea3 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Thu, 10 Aug 2017 21:32:31 -0700
Subject: [PATCH] [mpl] handle length computation overflow when inserting MPL
 header (#2092)

Credit to OSS-Fuzz.
---
 src/core/net/ip6.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp
index fc86b97a5..32342b47e 100644
--- a/src/core/net/ip6.cpp
+++ b/src/core/net/ip6.cpp
@@ -167,7 +167,7 @@ otError Ip6::InsertMplOption(Message &aMessage, Header &aIp6Header, MessageInfo
         if (aIp6Header.GetNextHeader() == kProtoHopOpts)
         {
             HopByHopHeader hbh;
-            uint8_t hbhLength = 0;
+            uint16_t hbhLength = 0;
             OptionMpl mplOption;
 
             // read existing hop-by-hop option header