From 7d23c9009a367399d910ca0c979d4e2b5ac7f35a Mon Sep 17 00:00:00 2001
From: Abtin Keshavarzian <abtink@google.com>
Date: Fri, 19 Dec 2025 12:16:44 -0800
Subject: [PATCH] [hist-tracker] use `Tlv::ParsedInfo` for robust TLV parsing
 (#12229)

This commit updates `Server::PrepareAndSendAnswers()` to utilize
`Tlv::ParsedInfo` for more robust TLV parsing and validation. This
ensures correct validation and size calculation for both standard and
extended TLVs when iterating over TLVs through the received message.

This change also adds an explicit check to skip over extended TLVs,
ensuring the implementation correctly handles cases where extended
TLVs may be present.
---
 src/core/utils/history_tracker_server.cpp | 26 +++++++++++++----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/src/core/utils/history_tracker_server.cpp b/src/core/utils/history_tracker_server.cpp
index e42a5c099..20a44a684 100644
--- a/src/core/utils/history_tracker_server.cpp
+++ b/src/core/utils/history_tracker_server.cpp
@@ -128,13 +128,13 @@ void Server::FreeAllRelatedAnswers(Coap::Message &aFirstAnswer)
 
 void Server::PrepareAndSendAnswers(const Ip6::Address &aDestination, const Message &aRequest)
 {
-    Coap::Message *answer;
-    Error          error;
-    AnswerInfo     info;
-    OffsetRange    offsetRange;
-    Tlv            tlv;
-    RequestTlv     requestTlv;
-    AnswerTlv      answerTlv;
+    Coap::Message  *answer;
+    Error           error;
+    AnswerInfo      info;
+    OffsetRange     offsetRange;
+    Tlv::ParsedInfo tlvInfo;
+    RequestTlv      requestTlv;
+    AnswerTlv       answerTlv;
 
     if (Tlv::Find<QueryIdTlv>(aRequest, info.mQueryId) == kErrorNone)
     {
@@ -147,12 +147,16 @@ void Server::PrepareAndSendAnswers(const Ip6::Address &aDestination, const Messa
 
     offsetRange.InitFromMessageOffsetToEnd(aRequest);
 
-    for (; !offsetRange.IsEmpty(); offsetRange.AdvanceOffset(tlv.GetSize()))
+    for (; !offsetRange.IsEmpty(); offsetRange.AdvanceOffset(tlvInfo.GetSize()))
     {
-        SuccessOrExit(error = aRequest.Read(offsetRange, tlv));
-        VerifyOrExit(offsetRange.Contains(tlv.GetSize()), error = kErrorParse);
+        SuccessOrExit(error = tlvInfo.ParseFrom(aRequest, offsetRange));
 
-        if (tlv.GetType() == Tlv::kRequest)
+        if (tlvInfo.mIsExtended)
+        {
+            continue;
+        }
+
+        if (tlvInfo.mType == Tlv::kRequest)
         {
             SuccessOrExit(error = aRequest.Read(offsetRange, requestTlv));
             VerifyOrExit(requestTlv.IsValid(), error = kErrorParse);