espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-31 16:17:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[network-data] check serverTlv data length before parsing (#6052)

Browse Source 
This commit adds a check in `GetBackboneRouterPrimary()` to verify
that the server sub-TLV data length is larger than a expected minimum
before casting it to `BackboneRouterServerData` and parsing/reading the
info.
This commit is contained in:
Abtin Keshavarzian
2021-01-09 12:27:34 -08:00
committed by GitHub
parent 948ad52565
commit a774d43fe9
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/thread/network_data_leader.cpp
+8 -2
View File
@@ -110,8 +110,14 @@ otError LeaderBase::GetBackboneRouterPrimary(BackboneRouter::BackboneRouterConfi
for (const NetworkDataTlv *start = serviceTlv->GetSubTlvs();
(serverTlv = FindTlv<ServerTlv>(start, serviceTlv->GetNext())) != nullptr; start = serverTlv->GetNext())
{
const BackboneRouterServerData *serverData =
reinterpret_cast<const BackboneRouterServerData *>(serverTlv->GetServerData());
const BackboneRouterServerData *serverData;
if (serverTlv->GetServerDataLength() < sizeof(BackboneRouterServerData))
{
continue;
}
serverData = reinterpret_cast<const BackboneRouterServerData *>(serverTlv->GetServerData());
if (rvalServerTlv == nullptr ||
(serverTlv->GetServer16() == Mle::Mle::Rloc16FromRouterId(Get<Mle::MleRouter>().GetLeaderId())) ||