From a09d8da38ccb5e4287bc3f41dbf8553c3f5db7bd Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Thu, 18 Apr 2019 13:29:59 -0700
Subject: [PATCH] [mpl] discard datagrams with multiple MPL Options (#3764)

Credit to OSS-Fuzz.
---
 src/core/net/ip6.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp
index fa685121d..ee6eb3abc 100644
--- a/src/core/net/ip6.cpp
+++ b/src/core/net/ip6.cpp
@@ -358,6 +358,9 @@ otError Ip6::RemoveMplOption(Message &aMessage)
         switch (option.GetType())
         {
         case OptionMpl::kType:
+            // if multiple MPL options exist, discard packet
+            VerifyOrExit(mplOffset == 0, error = OT_ERROR_PARSE);
+
             mplOffset = offset;
             mplLength = option.GetLength();