[network-data] add length validation to Server TLV (#2532)

Credit to OSS-Fuzz.

src/core/thread/network_data_leader_ftd.cpp

@@ -543,6 +543,7 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t *
                 {
                 case NetworkDataTlv::kTypeServer:
                     server = static_cast<ServerTlv *>(subCur);
+                    VerifyOrExit(server->IsValid(), error = OT_ERROR_PARSE);
 
                     if (server->GetServer16() == aRloc16)
                     {

src/core/thread/network_data_tlvs.hpp

@@ -923,6 +923,17 @@ public:
      */
     void Init(void) { NetworkDataTlv::Init(); SetType(kTypeServer); SetLength(sizeof(*this) - sizeof(NetworkDataTlv)); }
 
+    /**
+     * This method indicates whether or not the TLV appears to be well-formed.
+     *
+     * @retval TRUE   If the TLV appears to be well-formed.
+     * @retval FALSE  If the TLV does not appear to be well-formed.
+     *
+     */
+    bool IsValid(void) const {
+        return GetLength() >= (sizeof(*this) - sizeof(NetworkDataTlv));
+    }
+
     /**
      * This method returns the S_server_16 value.
      *