[router-table] add arg bounds check to Release() (#3521)

include/openthread/thread_ftd.h

@@ -333,6 +333,7 @@ OTAPI void OTCALL otThreadSetRouterUpgradeThreshold(otInstance *aInstance, uint8
  * @param[in]  aRouterId  The Router ID to release. Valid range is [0, 62].
  *
  * @retval OT_ERROR_NONE           Successfully released the router id.
+ * @retval OT_ERROR_INVALID_ARGS   @p aRouterId is not in the range [0, 62].
  * @retval OT_ERROR_INVALID_STATE  The device is not currently operating as a leader.
  * @retval OT_ERROR_NOT_FOUND      The router id is not currently allocated.
  *

src/core/api/thread_ftd_api.cpp

@@ -166,9 +166,15 @@ void otThreadSetRouterUpgradeThreshold(otInstance *aInstance, uint8_t aThreshold
 
 otError otThreadReleaseRouterId(otInstance *aInstance, uint8_t aRouterId)
 {
+    otError   error    = OT_ERROR_NONE;
     Instance &instance = *static_cast<Instance *>(aInstance);
 
-    return instance.GetThreadNetif().GetMle().GetRouterTable().Release(aRouterId);
+    VerifyOrExit(aRouterId <= Mle::kMaxRouterId, error = OT_ERROR_INVALID_ARGS);
+
+    error = instance.GetThreadNetif().GetMle().GetRouterTable().Release(aRouterId);
+
+exit:
+    return error;
 }
 
 otError otThreadBecomeRouter(otInstance *aInstance)

src/core/thread/router_table.cpp

@@ -261,6 +261,8 @@ otError RouterTable::Release(uint8_t aRouterId)
     ThreadNetif &netif  = GetNetif();
     uint16_t     rloc16 = Mle::Mle::GetRloc16(aRouterId);
 
+    assert(aRouterId <= Mle::kMaxRouterId);
+
     VerifyOrExit(netif.GetMle().GetRole() == OT_DEVICE_ROLE_LEADER, error = OT_ERROR_INVALID_STATE);
     VerifyOrExit(IsAllocated(aRouterId), error = OT_ERROR_NOT_FOUND);