espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-08 02:00:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Validate reads on receive path. (#939)

Browse Source
This commit is contained in:
Jonathan Hui
2016-11-07 22:08:22 -08:00
committed by GitHub
parent 14a421e341
commit b5c5079a6a
5 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/net/ip6.cpp
+15 -10
View File
@@ -452,14 +452,20 @@ ThreadError Ip6::HandleOptions(Message &message, Header &header, bool &forward)
OptionHeader optionHeader;
uint16_t endOffset;
message.Read(message.GetOffset(), sizeof(hbhHeader), &hbhHeader);
VerifyOrExit(message.Read(message.GetOffset(), sizeof(hbhHeader), &hbhHeader) == sizeof(hbhHeader),
error = kThreadError_Drop);
endOffset = message.GetOffset() + (hbhHeader.GetLength() + 1) * 8;
VerifyOrExit(endOffset <= message.GetLength(), error = kThreadError_Drop);
message.MoveOffset(sizeof(optionHeader));
while (message.GetOffset() < endOffset)
{
message.Read(message.GetOffset(), sizeof(optionHeader), &optionHeader);
VerifyOrExit(message.Read(message.GetOffset(), sizeof(optionHeader), &optionHeader) == sizeof(optionHeader),
error = kThreadError_Drop);
VerifyOrExit(message.GetOffset() + sizeof(optionHeader) + optionHeader.GetLength() <= endOffset,
error = kThreadError_Drop);
switch (optionHeader.GetType())
{
@@ -509,7 +515,8 @@ ThreadError Ip6::HandleFragment(Message &message)
ThreadError error = kThreadError_None;
FragmentHeader fragmentHeader;
message.Read(message.GetOffset(), sizeof(fragmentHeader), &fragmentHeader);
VerifyOrExit(message.Read(message.GetOffset(), sizeof(fragmentHeader), &fragmentHeader) == sizeof(fragmentHeader),
error = kThreadError_Drop);
VerifyOrExit(fragmentHeader.GetOffset() == 0 && fragmentHeader.IsMoreFlagSet() == false,
error = kThreadError_Drop);
@@ -524,13 +531,12 @@ ThreadError Ip6::HandleExtensionHeaders(Message &message, Header &header, uint8_
bool receive)
{
ThreadError error = kThreadError_None;
ExtensionHeader extensionHeader;
ExtensionHeader extHeader;
while (receive == true || nextHeader == kProtoHopOpts)
{
VerifyOrExit(message.GetOffset() <= message.GetLength(), error = kThreadError_Drop);
message.Read(message.GetOffset(), sizeof(extensionHeader), &extensionHeader);
VerifyOrExit(message.Read(message.GetOffset(), sizeof(extHeader), &extHeader) == sizeof(extHeader),
error = kThreadError_Drop);
switch (nextHeader)
{
@@ -557,7 +563,7 @@ ThreadError Ip6::HandleExtensionHeaders(Message &message, Header &header, uint8_
ExitNow();
}
nextHeader = static_cast<uint8_t>(extensionHeader.GetNextHeader());
nextHeader = static_cast<uint8_t>(extHeader.GetNextHeader());
}
exit:
@@ -658,8 +664,7 @@ ThreadError Ip6::HandleDatagram(Message &message, Netif *netif, int8_t interface
#endif
// check message length
VerifyOrExit(message.GetLength() >= sizeof(header), error = kThreadError_Drop);
message.Read(0, sizeof(header), &header);
VerifyOrExit(message.Read(0, sizeof(header), &header) == sizeof(header), error = kThreadError_Drop);
payloadLength = header.GetPayloadLength();
// check Version