From 7c743f3d8d0527ca6fef83086fc0d836c5aee9fc Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Fri, 6 Jan 2017 15:32:08 -0800
Subject: [PATCH] Initialize `length` parameter before calling
 `otPlatSettingsGet()`. (#1116)

- Handle input length in `otPlatSettingsGet()` example.
---
 examples/platforms/utils/settings.cpp | 33 +++++++++++++++++----------
 src/core/meshcop/dataset.cpp          | 13 +++++++++--
 src/core/thread/mle.cpp               |  4 +++-
 src/core/thread/mle_router.cpp        | 17 +++++++++-----
 4 files changed, 46 insertions(+), 21 deletions(-)

diff --git a/examples/platforms/utils/settings.cpp b/examples/platforms/utils/settings.cpp
index d2c49949e..500f12544 100644
--- a/examples/platforms/utils/settings.cpp
+++ b/examples/platforms/utils/settings.cpp
@@ -341,6 +341,7 @@ ThreadError otPlatSettingsGet(otInstance *aInstance, uint16_t aKey, int aIndex,
 {
     ThreadError error = kThreadError_NotFound;
     uint32_t address = sSettingsBaseAddress + kSettingsFlagSize;
+    uint16_t valueLength = 0;
     int index = 0;
 
     (void)aInstance;
@@ -362,18 +363,22 @@ ThreadError otPlatSettingsGet(otInstance *aInstance, uint16_t aKey, int aIndex,
             {
                 if (index == aIndex)
                 {
+                    uint16_t readLength = block.length;
+
+                    // only perform read if an input buffer was passed in
+                    if (aValue != NULL && aValueLength != NULL)
+                    {
+                        // adjust read length if input buffer length is smaller
+                        if (readLength > *aValueLength)
+                        {
+                            readLength = *aValueLength;
+                        }
+
+                        utilsFlashRead(address + sizeof(struct settingsBlock), aValue, readLength);
+                    }
+
+                    valueLength = readLength;
                     error = kThreadError_None;
-
-                    if (aValueLength)
-                    {
-                        *aValueLength = block.length;
-                    }
-
-                    if (aValue)
-                    {
-                        VerifyOrExit(aValueLength, error = kThreadError_InvalidArgs);
-                        utilsFlashRead(address + sizeof(struct settingsBlock), aValue, block.length);
-                    }
                 }
 
                 index++;
@@ -383,7 +388,11 @@ ThreadError otPlatSettingsGet(otInstance *aInstance, uint16_t aKey, int aIndex,
         address += (getAlignLength(block.length) + sizeof(struct settingsBlock));
     }
 
-exit:
+    if (aValueLength != NULL)
+    {
+        *aValueLength = valueLength;
+    }
+
     return error;
 }
 
diff --git a/src/core/meshcop/dataset.cpp b/src/core/meshcop/dataset.cpp
index 3c58c02c9..b65e643e7 100644
--- a/src/core/meshcop/dataset.cpp
+++ b/src/core/meshcop/dataset.cpp
@@ -428,8 +428,17 @@ int Dataset::Compare(const Dataset &aCompare) const
 
 ThreadError Dataset::Restore(void)
 {
-    return otPlatSettingsGet(mInstance, static_cast<uint16_t>(mType == Tlv::kActiveTimestamp ? kKeyActiveDataset :
-                                                              kKeyPendingDataset), 0, mTlvs, &mLength);
+    ThreadError error;
+    uint16_t length = sizeof(mTlvs);
+
+    error = otPlatSettingsGet(mInstance, static_cast<uint16_t>(mType == Tlv::kActiveTimestamp ? kKeyActiveDataset :
+                                                               kKeyPendingDataset), 0, mTlvs, &length);
+    SuccessOrExit(error);
+
+    mLength = length;
+
+exit:
+    return error;
 }
 
 ThreadError Dataset::Store(void)
diff --git a/src/core/thread/mle.cpp b/src/core/thread/mle.cpp
index ad2bcf28b..85f3b72b8 100644
--- a/src/core/thread/mle.cpp
+++ b/src/core/thread/mle.cpp
@@ -268,9 +268,9 @@ ThreadError Mle::Restore(void)
     mNetif.GetActiveDataset().Restore();
     mNetif.GetPendingDataset().Restore();
 
+    length = sizeof(networkInfo);
     SuccessOrExit(error = otPlatSettingsGet(mNetif.GetInstance(), kKeyNetworkInfo, 0,
                                             reinterpret_cast<uint8_t *>(&networkInfo), &length));
-
     VerifyOrExit(length == sizeof(networkInfo), error = kThreadError_NotFound);
     VerifyOrExit(networkInfo.mDeviceState >= kDeviceStateChild, error = kThreadError_NotFound);
 
@@ -284,8 +284,10 @@ ThreadError Mle::Restore(void)
 
     if (networkInfo.mDeviceState == kDeviceStateChild)
     {
+        length = sizeof(mParent);
         SuccessOrExit(error = otPlatSettingsGet(mNetif.GetInstance(), kKeyParentInfo, 0,
                                                 reinterpret_cast<uint8_t *>(&mParent), &length));
+        VerifyOrExit(length == sizeof(mParent), error = kThreadError_NotFound);
     }
     else if (networkInfo.mDeviceState == kDeviceStateRouter || networkInfo.mDeviceState == kDeviceStateLeader)
     {
diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp
index d48c59194..f02b1fdda 100644
--- a/src/core/thread/mle_router.cpp
+++ b/src/core/thread/mle_router.cpp
@@ -3339,16 +3339,19 @@ exit:
 ThreadError MleRouter::RestoreChildren(void)
 {
     ThreadError error = kThreadError_None;
-    Child *child;
-    otChildInfo childInfo;
-    uint16_t length;
 
     for (uint8_t i = 0; i < kMaxChildren; i++)
     {
+        Child *child;
+        otChildInfo childInfo;
+        uint16_t length;
+
+        length = sizeof(childInfo);
         SuccessOrExit(otPlatSettingsGet(mNetif.GetInstance(), kKeyChildInfo, i,
                                         reinterpret_cast<uint8_t *>(&childInfo), &length));
-        VerifyOrExit((child = NewChild()) != NULL, error = kThreadError_NoBufs);
+        VerifyOrExit(length == sizeof(childInfo), ;);
 
+        VerifyOrExit((child = NewChild()) != NULL, error = kThreadError_NoBufs);
         memset(child, 0, sizeof(*child));
 
         memcpy(&child->mMacAddr, &childInfo.mExtAddress, sizeof(child->mMacAddr));
@@ -3369,13 +3372,15 @@ exit:
 ThreadError MleRouter::RemoveStoredChild(uint16_t aChildRloc16)
 {
     ThreadError error = kThreadError_NotFound;
-    otChildInfo childInfo;
-    uint16_t length;
 
     for (uint8_t i = 0; i < kMaxChildren; i++)
     {
+        otChildInfo childInfo;
+        uint16_t length = sizeof(childInfo);
+
         SuccessOrExit(otPlatSettingsGet(mNetif.GetInstance(), kKeyChildInfo, i,
                                         reinterpret_cast<uint8_t *>(&childInfo), &length));
+        VerifyOrExit(length == sizeof(childInfo), ;);
 
         if (childInfo.mRloc16 == aChildRloc16)
         {