From bcfa791912dd7bd3dd7432f9f6313b6dd5ca358b Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Wed, 22 May 2019 10:57:04 -0700 Subject: [PATCH] [mpl] add extra validation when removing MPL Option (#3851) --- src/core/net/ip6.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp index ee6eb3abc..1ab0a5a7c 100644 --- a/src/core/net/ip6.cpp +++ b/src/core/net/ip6.cpp @@ -364,6 +364,8 @@ otError Ip6::RemoveMplOption(Message &aMessage) mplOffset = offset; mplLength = option.GetLength(); + VerifyOrExit(mplLength <= sizeof(OptionMpl) - sizeof(OptionHeader), error = OT_ERROR_PARSE); + if (mplOffset == sizeof(ip6Header) + sizeof(hbh) && hbh.GetLength() == 0) { // first and only IPv6 Option, remove IPv6 HBH Option header