espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-29 15:17:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[network-data] fix pointer arithmetic on length checks (#2169)

Browse Source
This commit is contained in:
Jonathan Hui
2017-09-05 16:11:48 -07:00
committed by GitHub
parent b4858aa851
commit cbc883b932
2 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/thread/network_data.cpp
+8 -8
View File
@@ -104,7 +104,7 @@ otError NetworkData::GetNextOnMeshPrefix(otNetworkDataIterator *aIterator, uint1
BorderRouterTlv *borderRouter;
BorderRouterEntry *borderRouterEntry = NULL;
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
if (cur->GetType() != NetworkDataTlv::kTypePrefix)
{
@@ -174,7 +174,7 @@ otError NetworkData::GetNextExternalRoute(otNetworkDataIterator *aIterator, uint
HasRouteTlv *hasRoute;
HasRouteEntry *hasRouteEntry = NULL;
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
if (cur->GetType() != NetworkDataTlv::kTypePrefix)
{
@@ -442,7 +442,7 @@ BorderRouterTlv *NetworkData::FindBorderRouter(PrefixTlv &aPrefix)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypeBorderRouter)
{
@@ -464,7 +464,7 @@ BorderRouterTlv *NetworkData::FindBorderRouter(PrefixTlv &aPrefix, bool aStable)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypeBorderRouter &&
cur->IsStable() == aStable)
@@ -487,7 +487,7 @@ HasRouteTlv *NetworkData::FindHasRoute(PrefixTlv &aPrefix)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypeHasRoute)
{
@@ -509,7 +509,7 @@ HasRouteTlv *NetworkData::FindHasRoute(PrefixTlv &aPrefix, bool aStable)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypeHasRoute &&
cur->IsStable() == aStable)
@@ -532,7 +532,7 @@ ContextTlv *NetworkData::FindContext(PrefixTlv &aPrefix)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypeContext)
{
@@ -559,7 +559,7 @@ PrefixTlv *NetworkData::FindPrefix(const uint8_t *aPrefix, uint8_t aPrefixLength
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypePrefix)
{
src/core/thread/network_data_leader_ftd.cpp
+5 -6
View File
@@ -429,7 +429,7 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t *
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end, error = OT_ERROR_PARSE);
if (cur->GetType() == NetworkDataTlv::kTypePrefix)
{
@@ -441,8 +441,7 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t *
while (subCur < subEnd)
{
VerifyOrExit(subCur + sizeof(NetworkDataTlv) <= subEnd && subCur->GetNext() <= subEnd,
error = OT_ERROR_PARSE);
VerifyOrExit((subCur + 1) <= subEnd && subCur->GetNext() <= subEnd, error = OT_ERROR_PARSE);
switch (subCur->GetType())
{
@@ -515,7 +514,7 @@ bool Leader::IsStableUpdated(uint16_t aRloc16, uint8_t *aTlvs, uint8_t aTlvsLeng
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end);
if (cur->GetType() == NetworkDataTlv::kTypePrefix)
{
@@ -618,7 +617,7 @@ otError Leader::AddNetworkData(uint8_t *aTlvs, uint8_t aTlvsLength)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end, error = OT_ERROR_NONE);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end, error = OT_ERROR_NONE);
switch (cur->GetType())
{
@@ -648,7 +647,7 @@ otError Leader::AddPrefix(PrefixTlv &aPrefix)
while (cur < end)
{
VerifyOrExit(cur + sizeof(NetworkDataTlv) <= end && cur->GetNext() <= end, error = OT_ERROR_NONE);
VerifyOrExit((cur + 1) <= end && cur->GetNext() <= end, error = OT_ERROR_NONE);
switch (cur->GetType())
{