From 9ec07205cc17c2de80b06a8b1e181abde4fdbb1e Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Mon, 5 Feb 2018 17:06:36 +0000 Subject: [PATCH] [network-data] add length validation to Server TLV (#2532) Credit to OSS-Fuzz. --- src/core/thread/network_data_leader_ftd.cpp | 1 + src/core/thread/network_data_tlvs.hpp | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/src/core/thread/network_data_leader_ftd.cpp b/src/core/thread/network_data_leader_ftd.cpp index b6422dfe1..6f5418cf5 100644 --- a/src/core/thread/network_data_leader_ftd.cpp +++ b/src/core/thread/network_data_leader_ftd.cpp @@ -543,6 +543,7 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t * { case NetworkDataTlv::kTypeServer: server = static_cast(subCur); + VerifyOrExit(server->IsValid(), error = OT_ERROR_PARSE); if (server->GetServer16() == aRloc16) { diff --git a/src/core/thread/network_data_tlvs.hpp b/src/core/thread/network_data_tlvs.hpp index 94ad90eb3..20083b48c 100644 --- a/src/core/thread/network_data_tlvs.hpp +++ b/src/core/thread/network_data_tlvs.hpp @@ -923,6 +923,17 @@ public: */ void Init(void) { NetworkDataTlv::Init(); SetType(kTypeServer); SetLength(sizeof(*this) - sizeof(NetworkDataTlv)); } + /** + * This method indicates whether or not the TLV appears to be well-formed. + * + * @retval TRUE If the TLV appears to be well-formed. + * @retval FALSE If the TLV does not appear to be well-formed. + * + */ + bool IsValid(void) const { + return GetLength() >= (sizeof(*this) - sizeof(NetworkDataTlv)); + } + /** * This method returns the S_server_16 value. *