[border-agent] check read UdpEncapsulationTlv length (#3414)

This commit verifies that the read length of `UdpEncapsulationTlv`
from a message is valid before processing it. Credit to Coverity.
This commit is contained in:
Abtin Keshavarzian
2018-12-28 17:12:09 -08:00
committed by Jonathan Hui
parent aabcd38db5
commit 4b1070444d
+1 -1
View File
@@ -335,7 +335,7 @@ void BorderAgent::HandleProxyTransmit(const Coap::Header &aHeader, const Message
UdpEncapsulationTlv tlv;
SuccessOrExit(error = Tlv::GetOffset(aMessage, Tlv::kUdpEncapsulation, offset));
aMessage.Read(offset, sizeof(tlv), &tlv);
VerifyOrExit(aMessage.Read(offset, sizeof(tlv), &tlv) == sizeof(tlv), error = OT_ERROR_PARSE);
VerifyOrExit((message = GetInstance().GetIp6().GetUdp().NewMessage(0)) != NULL, error = OT_ERROR_NO_BUFS);
SuccessOrExit(error = message->SetLength(tlv.GetUdpLength()));