From 59b94b4ca798ba4d3086613969b11dbe488facc8 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Thu, 3 Aug 2017 22:43:30 -0700
Subject: [PATCH] [mpl] validate HBH header length when inserting MPL Option
 (#2058)

Credit to OSS-Fuzz.
---
 src/core/net/ip6.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp
index 2554f5e4a..04e1f5c0f 100644
--- a/src/core/net/ip6.cpp
+++ b/src/core/net/ip6.cpp
@@ -174,6 +174,8 @@ otError Ip6::InsertMplOption(Message &aMessage, Header &aIp6Header, MessageInfo
             aMessage.Read(0, sizeof(hbh), &hbh);
             hbhLength = (hbh.GetLength() + 1) * 8;
 
+            VerifyOrExit(hbhLength <= aIp6Header.GetPayloadLength(), error = OT_ERROR_PARSE);
+
             // increase existing hop-by-hop option header length by 8 bytes
             hbh.SetLength(hbh.GetLength() + 1);
             aMessage.Write(0, sizeof(hbh), &hbh);