From 950c7c861246554e539daa6197530c405d7b8028 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Tue, 12 Mar 2019 10:47:25 -0700 Subject: [PATCH] [meshcop] avoid shift exponent too large in ChannelTlv processing (#3673) --- include/openthread/platform/radio.h | 1 + src/core/meshcop/meshcop_tlvs.cpp | 1 + 2 files changed, 2 insertions(+) diff --git a/include/openthread/platform/radio.h b/include/openthread/platform/radio.h index 1000c1f88..d9d822e1f 100644 --- a/include/openthread/platform/radio.h +++ b/include/openthread/platform/radio.h @@ -87,6 +87,7 @@ enum OT_RADIO_CHANNEL_PAGE_0_MASK = (1U << OT_RADIO_CHANNEL_PAGE_0), ///< 2.4 GHz IEEE 802.15.4-2006 OT_RADIO_CHANNEL_PAGE_2 = 2, ///< 915 MHz IEEE 802.15.4-2006 OT_RADIO_CHANNEL_PAGE_2_MASK = (1U << OT_RADIO_CHANNEL_PAGE_2), ///< 915 MHz IEEE 802.15.4-2006 + OT_RADIO_CHANNEL_PAGE_MAX = OT_RADIO_CHANNEL_PAGE_2, ///< Maximum supported channel page value }; /** diff --git a/src/core/meshcop/meshcop_tlvs.cpp b/src/core/meshcop/meshcop_tlvs.cpp index 6fc0afe86..c319ab641 100644 --- a/src/core/meshcop/meshcop_tlvs.cpp +++ b/src/core/meshcop/meshcop_tlvs.cpp @@ -120,6 +120,7 @@ bool ChannelTlv::IsValid(void) const bool ret = false; VerifyOrExit(GetLength() == sizeof(*this) - sizeof(Tlv)); + VerifyOrExit(mChannelPage <= OT_RADIO_CHANNEL_PAGE_MAX); VerifyOrExit((1U << mChannelPage) & Phy::kSupportedChannelPages); VerifyOrExit(Phy::kChannelMin <= GetChannel() && GetChannel() <= Phy::kChannelMax); ret = true;