espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-22 10:29:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

[tlvs] add additional length validation when reading tlvs (#2035)

Browse Source
This commit is contained in:
Jonathan Hui
2017-07-27 21:43:13 -07:00
committed by GitHub
parent 25759d3596
commit 7a37d079d5
1 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/common/tlvs.cpp
+23 -17
View File
@@ -66,28 +66,32 @@ otError Tlv::GetOffset(const Message &aMessage, uint8_t aType, uint16_t &aOffset
uint16_t end = aMessage.GetLength();
Tlv tlv;
while (offset < end)
while (offset + sizeof(tlv) <= end)
{
aMessage.Read(offset, sizeof(Tlv), &tlv);
uint16_t length;
// skip extended TLV
if (tlv.GetLength() == kExtendedLength)
aMessage.Read(offset, sizeof(tlv), &tlv);
if (tlv.GetLength() != kExtendedLength)
{
uint16_t length = 0;
offset += sizeof(tlv);
aMessage.Read(offset, sizeof(length), &length);
offset += sizeof(length) + HostSwap16(length);
length = sizeof(tlv) + tlv.GetLength();
}
else if (tlv.GetType() == aType && (offset + sizeof(tlv) + tlv.GetLength()) <= end)
else
{
VerifyOrExit(offset + sizeof(tlv) + sizeof(length) <= end);
aMessage.Read(offset + sizeof(tlv), sizeof(length), &length);
length = sizeof(tlv) + sizeof(length) + HostSwap16(length);
}
VerifyOrExit(length <= end - offset);
if (tlv.GetType() == aType)
{
aOffset = offset;
ExitNow(error = OT_ERROR_NONE);
}
else
{
offset += sizeof(tlv) + tlv.GetLength();
}
offset += length;
}
exit:
@@ -99,24 +103,26 @@ otError Tlv::GetValueOffset(const Message &aMessage, uint8_t aType, uint16_t &aO
otError error = OT_ERROR_NOT_FOUND;
uint16_t offset = aMessage.GetOffset();
uint16_t end = aMessage.GetLength();
Tlv tlv;
while (offset < end)
while (offset + sizeof(tlv) <= end)
{
Tlv tlv;
uint16_t length;
aMessage.Read(offset, sizeof(tlv), &tlv);
offset += sizeof(tlv);
length = tlv.GetLength();
if (length == kExtendedLength)
{
VerifyOrExit(offset + sizeof(length) <= end);
aMessage.Read(offset, sizeof(length), &length);
offset += sizeof(length);
length = HostSwap16(length);
}
VerifyOrExit(length <= end - offset);
if (tlv.GetType() == aType)
{
aOffset = offset;