From 50942427deeb3e4a6e79901a2c077e582cc90d89 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Tue, 31 Oct 2017 13:47:36 -0700 Subject: [PATCH] [mle] fix bug in forming Child ID Response message (#2306) This commit fixes an overflow issue when forming the Address Registration TLV within an MLE Child ID Response message. The overflow can cause the resulting message to be malformed. --- src/core/thread/mle_router.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp index 0bafc4807..69fe6a63d 100644 --- a/src/core/thread/mle_router.cpp +++ b/src/core/thread/mle_router.cpp @@ -4506,7 +4506,7 @@ otError MleRouter::AppendChildAddresses(Message &aMessage, Child &aChild) AddressRegistrationEntry entry; Lowpan::Context context; uint8_t length = 0; - uint8_t startOffset = static_cast(aMessage.GetLength()); + uint16_t startOffset = aMessage.GetLength(); tlv.SetType(Tlv::kAddressRegistration); SuccessOrExit(error = aMessage.Append(&tlv, sizeof(tlv)));