From 898a10fd79fa0604abcb63697e6fb93495b6fd5d Mon Sep 17 00:00:00 2001
From: Simon Lin <simonlin@google.com>
Date: Wed, 28 Apr 2021 11:12:20 +0800
Subject: [PATCH] [joiner] avoid null dereference in CoAP response handler
 (#6510)

---
 src/core/meshcop/joiner.cpp | 14 ++++++++------
 src/core/meshcop/joiner.hpp |  2 +-
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/core/meshcop/joiner.cpp b/src/core/meshcop/joiner.cpp
index f9b05b12d..0b2122f5f 100644
--- a/src/core/meshcop/joiner.cpp
+++ b/src/core/meshcop/joiner.cpp
@@ -525,19 +525,21 @@ void Joiner::HandleJoinerFinalizeResponse(void *               aContext,
                                           Error                aResult)
 {
     static_cast<Joiner *>(aContext)->HandleJoinerFinalizeResponse(
-        *static_cast<Coap::Message *>(aMessage), static_cast<const Ip6::MessageInfo *>(aMessageInfo), aResult);
+        static_cast<Coap::Message *>(aMessage), static_cast<const Ip6::MessageInfo *>(aMessageInfo), aResult);
 }
 
-void Joiner::HandleJoinerFinalizeResponse(Coap::Message &aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult)
+void Joiner::HandleJoinerFinalizeResponse(Coap::Message *aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult)
 {
     OT_UNUSED_VARIABLE(aMessageInfo);
 
     uint8_t state;
 
-    VerifyOrExit(mState == kStateConnected && aResult == kErrorNone && aMessage.IsAck() &&
-                 aMessage.GetCode() == Coap::kCodeChanged);
+    VerifyOrExit(mState == kStateConnected && aResult == kErrorNone);
+    OT_ASSERT(aMessage != nullptr);
 
-    SuccessOrExit(Tlv::Find<StateTlv>(aMessage, state));
+    VerifyOrExit(aMessage->IsAck() && aMessage->GetCode() == Coap::kCodeChanged);
+
+    SuccessOrExit(Tlv::Find<StateTlv>(*aMessage, state));
 
     SetState(kStateEntrust);
     mTimer.Start(kReponseTimeout);
@@ -545,7 +547,7 @@ void Joiner::HandleJoinerFinalizeResponse(Coap::Message &aMessage, const Ip6::Me
     otLogInfoMeshCoP("Joiner received finalize response %d", state);
 
 #if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
-    LogCertMessage("[THCI] direction=recv | type=JOIN_FIN.rsp |", aMessage);
+    LogCertMessage("[THCI] direction=recv | type=JOIN_FIN.rsp |", *aMessage);
 #endif
 
 exit:
diff --git a/src/core/meshcop/joiner.hpp b/src/core/meshcop/joiner.hpp
index 0f9677370..6df4ec689 100644
--- a/src/core/meshcop/joiner.hpp
+++ b/src/core/meshcop/joiner.hpp
@@ -194,7 +194,7 @@ private:
                                              otMessage *          aMessage,
                                              const otMessageInfo *aMessageInfo,
                                              Error                aResult);
-    void HandleJoinerFinalizeResponse(Coap::Message &aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult);
+    void HandleJoinerFinalizeResponse(Coap::Message *aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult);
 
     static void HandleJoinerEntrust(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo);
     void        HandleJoinerEntrust(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo);