From bf72fd8f8d4a898c019f279c8605e66fc0b42878 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Wed, 14 Nov 2018 17:31:29 -0800
Subject: [PATCH] [qos] check frame length when reading UDP header (#3298)

Credit to OSS-Fuzz.
---
 src/core/thread/mesh_forwarder.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/core/thread/mesh_forwarder.cpp b/src/core/thread/mesh_forwarder.cpp
index 6398181bf..ff9cf0094 100644
--- a/src/core/thread/mesh_forwarder.cpp
+++ b/src/core/thread/mesh_forwarder.cpp
@@ -1583,6 +1583,7 @@ otError MeshForwarder::GetFramePriority(uint8_t *           aFrame,
     }
     else
     {
+        VerifyOrExit(aFrameLength >= sizeof(Ip6::UdpHeader), error = OT_ERROR_PARSE);
         memcpy(&udpHeader, aFrame, sizeof(Ip6::UdpHeader));
     }