From b431bc34ce540395302e1a36b19f9a865a5d627c Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Thu, 24 Jan 2019 09:06:36 -0800
Subject: [PATCH] [network-data] avoid overflow in Service TLV length
 computation (#3506)

---
 src/core/thread/network_data_local.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/core/thread/network_data_local.cpp b/src/core/thread/network_data_local.cpp
index 3e63250a7..39897c319 100644
--- a/src/core/thread/network_data_local.cpp
+++ b/src/core/thread/network_data_local.cpp
@@ -177,7 +177,7 @@ otError Local::AddService(uint32_t       aEnterpriseNumber,
     otError     error = OT_ERROR_NONE;
     ServiceTlv *serviceTlv;
     ServerTlv * serverTlv;
-    uint8_t     serviceTlvLength =
+    size_t      serviceTlvLength =
         (sizeof(ServiceTlv) - sizeof(NetworkDataTlv)) + aServiceDataLength + sizeof(uint8_t) /*mServiceDataLength*/ +
         ServiceTlv::GetEnterpriseNumberFieldLength(aEnterpriseNumber) + aServerDataLength + sizeof(ServerTlv);
 
@@ -186,13 +186,13 @@ otError Local::AddService(uint32_t       aEnterpriseNumber,
     VerifyOrExit(mLength + sizeof(NetworkDataTlv) + serviceTlvLength <= sizeof(mTlvs), error = OT_ERROR_NO_BUFS);
 
     serviceTlv = reinterpret_cast<ServiceTlv *>(mTlvs + mLength);
-    Insert(reinterpret_cast<uint8_t *>(serviceTlv), serviceTlvLength + sizeof(NetworkDataTlv));
+    Insert(reinterpret_cast<uint8_t *>(serviceTlv), static_cast<uint8_t>(serviceTlvLength) + sizeof(NetworkDataTlv));
 
     serviceTlv->Init();
     serviceTlv->SetEnterpriseNumber(aEnterpriseNumber);
     serviceTlv->SetServiceID(0);
     serviceTlv->SetServiceData(aServiceData, aServiceDataLength);
-    serviceTlv->SetLength(serviceTlvLength);
+    serviceTlv->SetLength(static_cast<uint8_t>(serviceTlvLength));
 
     serverTlv = reinterpret_cast<ServerTlv *>(serviceTlv->GetSubTlvs());
     serverTlv->Init();