espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-15 13:40:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

[tlvs] fix overflow in TLV length calculation (#2108)

Browse Source
This commit is contained in:
Jonathan Hui
2017-08-17 14:26:21 -07:00
committed by GitHub
parent bfbf79fed8
commit 4decdad93d
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/common/tlvs.cpp
+8 -7
View File
@@ -68,22 +68,23 @@ otError Tlv::GetOffset(const Message &aMessage, uint8_t aType, uint16_t &aOffset
while (offset + sizeof(tlv) <= end) while (offset + sizeof(tlv) <= end)
{ {
uint16_t length; uint32_t length = sizeof(tlv);
aMessage.Read(offset, sizeof(tlv), &tlv); aMessage.Read(offset, sizeof(tlv), &tlv);
if (tlv.GetLength() != kExtendedLength) if (tlv.GetLength() != kExtendedLength)
{ {
length = sizeof(tlv) + tlv.GetLength(); length += tlv.GetLength();
} }
else else
{ {
VerifyOrExit(offset + sizeof(tlv) + sizeof(length) <= end); uint16_t extLength;
aMessage.Read(offset + sizeof(tlv), sizeof(length), &length);
length = sizeof(tlv) + sizeof(length) + HostSwap16(length); VerifyOrExit(sizeof(extLength) == aMessage.Read(offset + sizeof(tlv), sizeof(extLength), &extLength));
length += sizeof(extLength) + HostSwap16(extLength);
} }
VerifyOrExit(length <= end - offset); VerifyOrExit(offset + length <= end);
if (tlv.GetType() == aType) if (tlv.GetType() == aType)
{ {
@@ -91,7 +92,7 @@ otError Tlv::GetOffset(const Message &aMessage, uint8_t aType, uint16_t &aOffset
ExitNow(error = OT_ERROR_NONE); ExitNow(error = OT_ERROR_NONE);
} }
offset += length; offset += static_cast<uint16_t>(length);
} }
exit: exit: