From 803168cf5ae7e0cb5d55ef8f94b3b754bd3d7d6a Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Wed, 16 Jan 2019 00:16:58 -0800
Subject: [PATCH] [spinel] add bounds checks when decoding uint (#3459)

---
 src/ncp/spinel.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/ncp/spinel.c b/src/ncp/spinel.c
index 33875b1c1..e96ff4ee8 100644
--- a/src/ncp/spinel.c
+++ b/src/ncp/spinel.c
@@ -46,6 +46,7 @@
 #include "spinel.h"
 
 #include <errno.h>
+#include <limits.h>
 
 #ifndef SPINEL_PLATFORM_HEADER
 /* These are all already included in the spinel platform header
@@ -151,17 +152,17 @@ spinel_ssize_t spinel_packed_uint_decode(const uint8_t *bytes, spinel_size_t len
     spinel_ssize_t ret   = 0;
     unsigned int   value = 0;
 
-    int i = 0;
+    unsigned int i = 0;
 
     do
     {
-        if (len < sizeof(uint8_t))
+        if ((len < sizeof(uint8_t)) || (i >= sizeof(unsigned int) * CHAR_BIT))
         {
             ret = -1;
             break;
         }
 
-        value |= (unsigned int)((bytes[0] & 0x7F) << i);
+        value |= (unsigned int)(bytes[0] & 0x7F) << i;
         i += 7;
         ret += sizeof(uint8_t);
         bytes += sizeof(uint8_t);