From ba148cf5bf7fa7cc445fb53c4aa88886d01e76d0 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Fri, 15 Sep 2017 10:42:02 -0700
Subject: [PATCH] [commissioning-dataset] add TLV validation in
 HandleCommissioningSet (#2193)

This commit adds a validation check when reading the Commissioning
Session ID TLV in HandleCommissioningSet().

Credit to OSS-Fuzz.
---
 src/core/thread/network_data_leader_ftd.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/core/thread/network_data_leader_ftd.cpp b/src/core/thread/network_data_leader_ftd.cpp
index b58a0b5cc..82e334801 100644
--- a/src/core/thread/network_data_leader_ftd.cpp
+++ b/src/core/thread/network_data_leader_ftd.cpp
@@ -237,8 +237,11 @@ void Leader::HandleCommissioningSet(Coap::Header &aHeader, Message &aMessage, co
         }
         else if (type == MeshCoP::Tlv::kCommissionerSessionId)
         {
+            MeshCoP::CommissionerSessionIdTlv *tlv = static_cast<MeshCoP::CommissionerSessionIdTlv *>(cur);
+
+            VerifyOrExit(tlv->IsValid());
+            sessionId = tlv->GetCommissionerSessionId();
             hasSessionId = true;
-            sessionId = static_cast<MeshCoP::CommissionerSessionIdTlv *>(cur)->GetCommissionerSessionId();
         }
         else
         {