espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-31 16:17:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mle] add length check for AES-CCM tag (#2106)

Browse Source 
Credit to OSS-Fuzz.
This commit is contained in:
Jonathan Hui
2017-08-15 15:59:10 -07:00
committed by GitHub
parent e52d7733c6
commit f2ddf8ce15
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/thread/mle.cpp
+4 -6
View File
@@ -1995,7 +1995,6 @@ void Mle::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageIn
const uint8_t *mleKey;
uint32_t frameCounter;
uint8_t messageTag[4];
uint16_t messageTagLength;
uint8_t nonce[13];
Mac::ExtAddress macAddr;
Crypto::AesCcm aesCcm;
@@ -2046,15 +2045,14 @@ void Mle::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageIn
mleKey = netif.GetKeyManager().GetTemporaryMleKey(keySequence);
}
VerifyOrExit(aMessage.GetOffset() + header.GetLength() + sizeof(messageTag) <= aMessage.GetLength());
aMessage.MoveOffset(header.GetLength() - 1);
frameCounter = header.GetFrameCounter();
messageTagLength = aMessage.Read(aMessage.GetLength() - sizeof(messageTag), sizeof(messageTag), messageTag);
VerifyOrExit(messageTagLength == sizeof(messageTag));
aMessage.Read(aMessage.GetLength() - sizeof(messageTag), sizeof(messageTag), messageTag);
SuccessOrExit(aMessage.SetLength(aMessage.GetLength() - sizeof(messageTag)));
aMessageInfo.GetPeerAddr().ToExtAddress(macAddr);
frameCounter = header.GetFrameCounter();
GenerateNonce(macAddr, frameCounter, Mac::Frame::kSecEncMic32, nonce);
aesCcm.SetKey(mleKey, 16);
@@ -2082,7 +2080,7 @@ void Mle::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageIn
tagLength = sizeof(tag);
aesCcm.Finalize(tag, &tagLength);
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
VerifyOrExit(messageTagLength == tagLength && memcmp(messageTag, tag, tagLength) == 0);
VerifyOrExit(memcmp(messageTag, tag, sizeof(tag)) == 0);
#endif
if (keySequence > netif.GetKeyManager().GetCurrentKeySequence())