espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-28 14:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mle] validate received message length is >= header length (#2021)

Browse Source 
Credit to OSS-Fuzz.
This commit is contained in:
Jonathan Hui
2017-07-23 22:01:57 -07:00
committed by GitHub
parent ffd28ebd4d
commit d200df368c
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/thread/mle.cpp
+2 -2
View File
@@ -2007,8 +2007,8 @@ void Mle::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageIn
uint8_t command;
Neighbor *neighbor;
aMessage.Read(aMessage.GetOffset(), sizeof(header), &header);
VerifyOrExit(header.IsValid());
length = aMessage.Read(aMessage.GetOffset(), sizeof(header), &header);
VerifyOrExit(header.IsValid() && header.GetLength() <= length);
assert(aMessageInfo.GetLinkInfo() != NULL);