From d200df368c5be41265fd6446977b473a5fcffe09 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Sun, 23 Jul 2017 22:01:57 -0700 Subject: [PATCH] [mle] validate received message length is >= header length (#2021) Credit to OSS-Fuzz. --- src/core/thread/mle.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/core/thread/mle.cpp b/src/core/thread/mle.cpp index d44870ab6..3167a85dd 100644 --- a/src/core/thread/mle.cpp +++ b/src/core/thread/mle.cpp @@ -2007,8 +2007,8 @@ void Mle::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageIn uint8_t command; Neighbor *neighbor; - aMessage.Read(aMessage.GetOffset(), sizeof(header), &header); - VerifyOrExit(header.IsValid()); + length = aMessage.Read(aMessage.GetOffset(), sizeof(header), &header); + VerifyOrExit(header.IsValid() && header.GetLength() <= length); assert(aMessageInfo.GetLinkInfo() != NULL);