Fixed tlv length check. (ARMmbed#1992)

deepakvenugopal · web-flow · commit 8f10a6e65dc6 · 2019-02-26T09:30:56.000+02:00
diff --git a/source/6LoWPAN/Thread/thread_joiner_application.c b/source/6LoWPAN/Thread/thread_joiner_application.c
@@ -399,12 +399,12 @@ static int link_configuration_update(link_configuration_s *link_configuration, u
     if (thread_meshcop_tlv_find(msg_ptr, msg_len, MESHCOP_TLV_PSKC, &ptr) >= 16) {
         memcpy(link_configuration->PSKc, ptr, 16);
     }
-
-    if (thread_meshcop_tlv_find(msg_ptr, msg_len, MESHCOP_TLV_SECURITY_POLICY, &ptr) >= 3) {
+    uint16_t tlv_len = thread_meshcop_tlv_find(msg_ptr, msg_len, MESHCOP_TLV_SECURITY_POLICY, &ptr);
+    if (tlv_len  >= 3) {
         link_configuration->securityPolicyExt = SECURITY_POLICY_ALL_SECURITY;
         link_configuration->securityPolicy = ptr[2];
         link_configuration->key_rotation = common_read_16_bit(ptr);
-        if (msg_len > 3) {
+        if (tlv_len > 3) {
             link_configuration->securityPolicyExt = ptr[3];
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -399,12 +399,12 @@ static int link_configuration_update(link_configuration_s *link_configuration, u`
`399`	`399`	`if (thread_meshcop_tlv_find(msg_ptr, msg_len, MESHCOP_TLV_PSKC, &ptr) >= 16) {`
`400`	`400`	`memcpy(link_configuration->PSKc, ptr, 16);`
`401`	`401`	`}`
`402`		`-`
`403`		`- if (thread_meshcop_tlv_find(msg_ptr, msg_len, MESHCOP_TLV_SECURITY_POLICY, &ptr) >= 3) {`
	`402`	`+ uint16_t tlv_len = thread_meshcop_tlv_find(msg_ptr, msg_len, MESHCOP_TLV_SECURITY_POLICY, &ptr);`
	`403`	`+ if (tlv_len >= 3) {`
`404`	`404`	`link_configuration->securityPolicyExt = SECURITY_POLICY_ALL_SECURITY;`
`405`	`405`	`link_configuration->securityPolicy = ptr[2];`
`406`	`406`	`link_configuration->key_rotation = common_read_16_bit(ptr);`
`407`		`- if (msg_len > 3) {`
	`407`	`+ if (tlv_len > 3) {`
`408`	`408`	`link_configuration->securityPolicyExt = ptr[3];`
`409`	`409`	`}`
`410`	`410`	`}`