espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-14 14:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[network-data] avoid overflow in Service TLV length computation (#3506)

Browse Source
This commit is contained in:
Jonathan Hui
2019-01-24 09:06:36 -08:00
committed by GitHub
parent ce3c712fe6
commit b431bc34ce
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/thread/network_data_local.cpp
+3 -3
View File
@@ -177,7 +177,7 @@ otError Local::AddService(uint32_t aEnterpriseNumber,
otError error = OT_ERROR_NONE;
ServiceTlv *serviceTlv;
ServerTlv * serverTlv;
uint8_t serviceTlvLength =
size_t serviceTlvLength =
(sizeof(ServiceTlv) - sizeof(NetworkDataTlv)) + aServiceDataLength + sizeof(uint8_t) /*mServiceDataLength*/ +
ServiceTlv::GetEnterpriseNumberFieldLength(aEnterpriseNumber) + aServerDataLength + sizeof(ServerTlv);
@@ -186,13 +186,13 @@ otError Local::AddService(uint32_t aEnterpriseNumber,
VerifyOrExit(mLength + sizeof(NetworkDataTlv) + serviceTlvLength <= sizeof(mTlvs), error = OT_ERROR_NO_BUFS);
serviceTlv = reinterpret_cast<ServiceTlv *>(mTlvs + mLength);
Insert(reinterpret_cast<uint8_t *>(serviceTlv), serviceTlvLength + sizeof(NetworkDataTlv));
Insert(reinterpret_cast<uint8_t *>(serviceTlv), static_cast<uint8_t>(serviceTlvLength) + sizeof(NetworkDataTlv));
serviceTlv->Init();
serviceTlv->SetEnterpriseNumber(aEnterpriseNumber);
serviceTlv->SetServiceID(0);
serviceTlv->SetServiceData(aServiceData, aServiceDataLength);
serviceTlv->SetLength(serviceTlvLength);
serviceTlv->SetLength(static_cast<uint8_t>(serviceTlvLength));
serverTlv = reinterpret_cast<ServerTlv *>(serviceTlv->GetSubTlvs());
serverTlv->Init();