From af4837d122c9da0eb6dcb9f2a1b19b1e37b738cc Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Fri, 17 Apr 2020 21:19:22 -0700
Subject: [PATCH] [network-data] fix length overflow in ServiceTlv::IsValid()
 (#4855)

---
 src/core/thread/network_data_tlvs.hpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/core/thread/network_data_tlvs.hpp b/src/core/thread/network_data_tlvs.hpp
index b25309f3e..afcfc34d4 100644
--- a/src/core/thread/network_data_tlvs.hpp
+++ b/src/core/thread/network_data_tlvs.hpp
@@ -1015,7 +1015,9 @@ public:
         uint8_t length = GetLength();
 
         return (length >= sizeof(mFlagsServiceId)) &&
-               (length >= kMinLength + (IsThreadEnterprise() ? 0 : sizeof(uint32_t))) && (length >= GetFieldsLength());
+               (length >= kMinLength + (IsThreadEnterprise() ? 0 : sizeof(uint32_t))) &&
+               (static_cast<uint16_t>(length) + sizeof(NetworkDataTlv) >=
+                CalculateSize(GetEnterpriseNumber(), GetServiceDataLength()));
     }
 
     /**