[network-data] add length checks to Prefix TLV parsing (#2207)

Credit to OSS-Fuzz.

src/core/thread/network_data_leader_ftd.cpp

@@ -451,6 +451,8 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t *
         if (cur->GetType() == NetworkDataTlv::kTypePrefix)
         {
             prefix = static_cast<PrefixTlv *>(cur);
+            VerifyOrExit(prefix->IsValid(), error = OT_ERROR_PARSE);
+
             subCur = prefix->GetSubTlvs();
             subEnd = prefix->GetNext();
 
@@ -657,8 +659,12 @@ exit:
 otError Leader::AddPrefix(PrefixTlv &aPrefix)
 {
     otError error = OT_ERROR_NONE;
-    NetworkDataTlv *cur = aPrefix.GetSubTlvs();
-    NetworkDataTlv *end = aPrefix.GetNext();
+    NetworkDataTlv *cur;
+    NetworkDataTlv *end;
+
+    VerifyOrExit(aPrefix.IsValid(), error = OT_ERROR_PARSE);
+    cur = aPrefix.GetSubTlvs();
+    end = aPrefix.GetNext();
 
     while (cur < end)
     {

src/core/thread/network_data_tlvs.hpp

@@ -283,6 +283,18 @@ public:
         SetSubTlvsLength(0);
     }
 
+    /**
+     * This method indicates whether or not the TLV appears to be well-formed.
+     *
+     * @retval TRUE   If the TLV appears to be well-formed.
+     * @retval FALSE  If the TLV does not appear to be well-formed.
+     *
+     */
+    bool IsValid(void) const {
+        return ((GetLength() >= sizeof(*this) - sizeof(Tlv)) &&
+                (GetLength() >= BitVectorBytes(mPrefixLength) + sizeof(*this) - sizeof(Tlv)));
+    }
+
     /**
      * This method returns the Domain ID value.
      *