From a774d43fe90aaf71f62d8677df483820a07fb0c8 Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Sat, 9 Jan 2021 12:27:34 -0800 Subject: [PATCH] [network-data] check serverTlv data length before parsing (#6052) This commit adds a check in `GetBackboneRouterPrimary()` to verify that the server sub-TLV data length is larger than a expected minimum before casting it to `BackboneRouterServerData` and parsing/reading the info. --- src/core/thread/network_data_leader.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/core/thread/network_data_leader.cpp b/src/core/thread/network_data_leader.cpp index 250343b04..33eed1581 100644 --- a/src/core/thread/network_data_leader.cpp +++ b/src/core/thread/network_data_leader.cpp @@ -110,8 +110,14 @@ otError LeaderBase::GetBackboneRouterPrimary(BackboneRouter::BackboneRouterConfi for (const NetworkDataTlv *start = serviceTlv->GetSubTlvs(); (serverTlv = FindTlv(start, serviceTlv->GetNext())) != nullptr; start = serverTlv->GetNext()) { - const BackboneRouterServerData *serverData = - reinterpret_cast(serverTlv->GetServerData()); + const BackboneRouterServerData *serverData; + + if (serverTlv->GetServerDataLength() < sizeof(BackboneRouterServerData)) + { + continue; + } + + serverData = reinterpret_cast(serverTlv->GetServerData()); if (rvalServerTlv == nullptr || (serverTlv->GetServer16() == Mle::Mle::Rloc16FromRouterId(Get().GetLeaderId())) ||