From 44a7ba393a98da67969f775c8dac5d69f8e6c270 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Wed, 20 Dec 2017 17:04:03 +0000
Subject: [PATCH] [mle] increase Route TLV length to avoid buffer overflow
 (#2431)

Properly formed Route TLVs should never have more than 32 route entries.
This fix follows a "be liberal in what you accept" approach.

Credit to OSS-Fuzz.
---
 src/core/thread/mle_tlvs.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/thread/mle_tlvs.hpp b/src/core/thread/mle_tlvs.hpp
index 2ee070bcc..3d2fd1ff0 100644
--- a/src/core/thread/mle_tlvs.hpp
+++ b/src/core/thread/mle_tlvs.hpp
@@ -603,7 +603,7 @@ private:
     };
     uint8_t mRouterIdSequence;
     uint8_t mRouterIdMask[BitVectorBytes(kMaxRouterId + 1)];
-    uint8_t mRouteData[kMaxRouters];
+    uint8_t mRouteData[kMaxRouterId + 1];
 } OT_TOOL_PACKED_END;
 
 /**