espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-07 03:07:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[history] parse TLV headers safely in client answer processing (#13410)

Browse Source 
This commit updates `HistoryTracker::Client::ProcessNetInfoAnswer()`
to iterate over answer TLVs using `Tlv::Info::ParseFrom()`, which
reads the full TLV header, including any extended-length field, and
validates that the entire TLV is contained within the remaining
offset range. Extended TLVs are skipped, since all answer TLVs the
client consumes are non-extended.
This commit is contained in:
Griffin Francis
2026-07-27 16:20:35 -07:00
committed by GitHub
parent f5fb5a8379
commit c5168b783a
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/utils/history_tracker_client.cpp
+10 -6
View File
@@ -163,23 +163,27 @@ void Client::ProcessNetInfoAnswer(const Coap::Message &aMessage)
{
Error error = kErrorNone;
OffsetRange offsetRange;
Tlv tlv;
Tlv::Info tlvInfo;
NetworkInfoTlv netInfoTlv;
NetworkInfo netInfo;
offsetRange.InitFromMessageOffsetToEnd(aMessage);
for (; !offsetRange.IsEmpty(); offsetRange.AdvanceOffset(tlv.GetSize()))
for (; !offsetRange.IsEmpty(); offsetRange.AdvanceOffset(tlvInfo.GetSize()))
{
SuccessOrExit(error = aMessage.Read(offsetRange, tlv));
VerifyOrExit(offsetRange.Contains(tlv.GetSize()), error = kErrorParse);
SuccessOrExit(error = tlvInfo.ParseFrom(aMessage, offsetRange));
if (tlv.GetType() != Tlv::kNetworkInfo)
if (tlvInfo.IsExtended())
{
continue;
}
if (tlv.GetLength() == 0)
if (tlvInfo.GetType() != Tlv::kNetworkInfo)
{
continue;
}
if (tlvInfo.GetLength() == 0)
{
Finalize(kErrorNone);
ExitNow();