From 767a8eb9bbbf666d0ada853e24ba74397899c8ca Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Tue, 17 Sep 2019 17:11:15 -0700 Subject: [PATCH] [tlvs] add length check in Tlv::Find for extended tlvs (#4176) --- src/core/common/tlvs.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/core/common/tlvs.cpp b/src/core/common/tlvs.cpp index 02893c5d4..a23bc342d 100644 --- a/src/core/common/tlvs.cpp +++ b/src/core/common/tlvs.cpp @@ -128,6 +128,8 @@ otError Tlv::Find(const Message &aMessage, uint8_t aType, uint16_t *aOffset, uin VerifyOrExit(sizeof(ExtendedTlv) <= remainingLen); aMessage.Read(offset, sizeof(ExtendedTlv), &extTlv); + + VerifyOrExit(extTlv.GetLength() <= (remainingLen - sizeof(ExtendedTlv))); size = extTlv.GetSize(); }