Validate reads on receive path. (#939)

src/core/net/dhcp6_client.cpp

@@ -513,9 +513,7 @@ void Dhcp6Client::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aM
     Dhcp6Header header;
     (void)aMessageInfo;
 
-    VerifyOrExit(aMessage.GetLength() - aMessage.GetOffset() >= static_cast<uint16_t>(sizeof(Dhcp6Header)), ;);
-
-    aMessage.Read(aMessage.GetOffset(), sizeof(header), &header);
+    VerifyOrExit(aMessage.Read(aMessage.GetOffset(), sizeof(header), &header) == sizeof(header),);
     aMessage.MoveOffset(sizeof(header));
 
     if ((header.GetType() == kTypeReply) && (!memcmp(header.GetTransactionId(), mTransactionId, kTransactionIdSize)))
@@ -561,7 +559,7 @@ uint16_t Dhcp6Client::FindOption(Message &aMessage, uint16_t aOffset, uint16_t a
     while (aOffset <= end)
     {
         Dhcp6Option option;
-        aMessage.Read(aOffset, sizeof(option), &option);
+        VerifyOrExit(aMessage.Read(aOffset, sizeof(option), &option) == sizeof(option),);
 
         if (option.GetCode() == (aCode))
         {
@@ -571,6 +569,7 @@ uint16_t Dhcp6Client::FindOption(Message &aMessage, uint16_t aOffset, uint16_t a
         aOffset += sizeof(option) + option.GetLength();
     }
 
+exit:
     return 0;
 }
 

src/core/net/dhcp6_server.cpp

@@ -254,9 +254,7 @@ void Dhcp6Server::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aM
     Dhcp6Header header;
     otIp6Address dst = aMessageInfo.mPeerAddr;
 
-    VerifyOrExit(aMessage.GetLength() - aMessage.GetOffset() >= static_cast<uint16_t>(sizeof(Dhcp6Header)), ;);
-
-    aMessage.Read(aMessage.GetOffset(), sizeof(header), &header);
+    VerifyOrExit(aMessage.Read(aMessage.GetOffset(), sizeof(header), &header) == sizeof(header),);
     aMessage.MoveOffset(sizeof(header));
 
     // discard if not solicit type
@@ -309,7 +307,7 @@ uint16_t Dhcp6Server::FindOption(Message &aMessage, uint16_t aOffset, uint16_t a
     while (aOffset <= end)
     {
 	Dhcp6Option option;
-	aMessage.Read(aOffset, sizeof(option), &option);
+	VerifyOrExit(aMessage.Read(aOffset, sizeof(option), &option) == sizeof(option),);
 
 	if (option.GetCode() == aCode)
 	{
@@ -319,6 +317,7 @@ uint16_t Dhcp6Server::FindOption(Message &aMessage, uint16_t aOffset, uint16_t a
 	aOffset += sizeof(option) + option.GetLength();
     }
 
+exit:
     return 0;
 }
 ThreadError Dhcp6Server::ProcessClientIdentifier(Message &aMessage, uint16_t aOffset, ClientIdentifier &aClient)
@@ -350,7 +349,7 @@ ThreadError Dhcp6Server::ProcessIaNa(Message &aMessage, uint16_t aOffset, IaNa &
 {
     ThreadError error = kThreadError_None;
     uint16_t optionOffset;
-    int length;
+    uint16_t length;
 
     VerifyOrExit((aMessage.Read(aOffset, sizeof(aIaNa), &aIaNa) == sizeof(aIaNa)), error = kThreadError_Parse);
 

src/core/net/icmp6.cpp

@@ -151,12 +151,9 @@ ThreadError Icmp::HandleMessage(Message &aMessage, MessageInfo &aMessageInfo)
     IcmpHeader icmp6Header;
     uint16_t checksum;
 
+    VerifyOrExit(aMessage.Read(aMessage.GetOffset(), sizeof(icmp6Header), &icmp6Header) == sizeof(icmp6Header),);
     payloadLength = aMessage.GetLength() - aMessage.GetOffset();
 
-    // check length
-    VerifyOrExit(payloadLength >= IcmpHeader::GetDataOffset(),  error = kThreadError_Drop);
-    aMessage.Read(aMessage.GetOffset(), sizeof(icmp6Header), &icmp6Header);
-
     // verify checksum
     checksum = Ip6::ComputePseudoheaderChecksum(aMessageInfo.GetPeerAddr(), aMessageInfo.GetSockAddr(),
                                                 payloadLength, kProtoIcmp6);

src/core/net/ip6.cpp

@@ -452,14 +452,20 @@ ThreadError Ip6::HandleOptions(Message &message, Header &header, bool &forward)
     OptionHeader optionHeader;
     uint16_t endOffset;
 
-    message.Read(message.GetOffset(), sizeof(hbhHeader), &hbhHeader);
+    VerifyOrExit(message.Read(message.GetOffset(), sizeof(hbhHeader), &hbhHeader) == sizeof(hbhHeader),
+                 error = kThreadError_Drop);
     endOffset = message.GetOffset() + (hbhHeader.GetLength() + 1) * 8;
 
+    VerifyOrExit(endOffset <= message.GetLength(), error = kThreadError_Drop);
+
     message.MoveOffset(sizeof(optionHeader));
 
     while (message.GetOffset() < endOffset)
     {
-        message.Read(message.GetOffset(), sizeof(optionHeader), &optionHeader);
+        VerifyOrExit(message.Read(message.GetOffset(), sizeof(optionHeader), &optionHeader) == sizeof(optionHeader),
+                     error = kThreadError_Drop);
+        VerifyOrExit(message.GetOffset() + sizeof(optionHeader) + optionHeader.GetLength() <= endOffset,
+                     error = kThreadError_Drop);
 
         switch (optionHeader.GetType())
         {
@@ -509,7 +515,8 @@ ThreadError Ip6::HandleFragment(Message &message)
     ThreadError error = kThreadError_None;
     FragmentHeader fragmentHeader;
 
-    message.Read(message.GetOffset(), sizeof(fragmentHeader), &fragmentHeader);
+    VerifyOrExit(message.Read(message.GetOffset(), sizeof(fragmentHeader), &fragmentHeader) == sizeof(fragmentHeader),
+                 error = kThreadError_Drop);
 
     VerifyOrExit(fragmentHeader.GetOffset() == 0 && fragmentHeader.IsMoreFlagSet() == false,
                  error = kThreadError_Drop);
@@ -524,13 +531,12 @@ ThreadError Ip6::HandleExtensionHeaders(Message &message, Header &header, uint8_
                                         bool receive)
 {
     ThreadError error = kThreadError_None;
-    ExtensionHeader extensionHeader;
+    ExtensionHeader extHeader;
 
     while (receive == true || nextHeader == kProtoHopOpts)
     {
-        VerifyOrExit(message.GetOffset() <= message.GetLength(), error = kThreadError_Drop);
-
-        message.Read(message.GetOffset(), sizeof(extensionHeader), &extensionHeader);
+        VerifyOrExit(message.Read(message.GetOffset(), sizeof(extHeader), &extHeader) == sizeof(extHeader),
+                     error = kThreadError_Drop);
 
         switch (nextHeader)
         {
@@ -557,7 +563,7 @@ ThreadError Ip6::HandleExtensionHeaders(Message &message, Header &header, uint8_
             ExitNow();
         }
 
-        nextHeader = static_cast<uint8_t>(extensionHeader.GetNextHeader());
+        nextHeader = static_cast<uint8_t>(extHeader.GetNextHeader());
     }
 
 exit:
@@ -658,8 +664,7 @@ ThreadError Ip6::HandleDatagram(Message &message, Netif *netif, int8_t interface
 #endif
 
     // check message length
-    VerifyOrExit(message.GetLength() >= sizeof(header), error = kThreadError_Drop);
-    message.Read(0, sizeof(header), &header);
+    VerifyOrExit(message.Read(0, sizeof(header), &header) == sizeof(header), error = kThreadError_Drop);
     payloadLength = header.GetPayloadLength();
 
     // check Version

src/core/net/udp6.cpp

@@ -203,7 +203,7 @@ ThreadError Udp::HandleMessage(Message &aMessage, MessageInfo &aMessageInfo)
     checksum = aMessage.UpdateChecksum(checksum, aMessage.GetOffset(), payloadLength);
     VerifyOrExit(checksum == 0xffff, ;);
 
-    aMessage.Read(aMessage.GetOffset(), sizeof(udpHeader), &udpHeader);
+    VerifyOrExit(aMessage.Read(aMessage.GetOffset(), sizeof(udpHeader), &udpHeader) == sizeof(udpHeader),);
     aMessage.MoveOffset(sizeof(udpHeader));
     aMessageInfo.mPeerPort = udpHeader.GetSourcePort();
     aMessageInfo.mSockPort = udpHeader.GetDestinationPort();