diff --git a/net/dcsctp/packet/tlv_trait.h b/net/dcsctp/packet/tlv_trait.h index 11c3852d38..7e2e58d601 100644 --- a/net/dcsctp/packet/tlv_trait.h +++ b/net/dcsctp/packet/tlv_trait.h @@ -105,7 +105,7 @@ class TLVTrait { } } else { // Expect variable length data - verify its size alignment. - if (length > data.size()) { + if (length > data.size() || length < Config::kHeaderSize) { tlv_trait_impl::ReportInvalidVariableLengthField(length, data.size()); return absl::nullopt; } diff --git a/net/dcsctp/packet/tlv_trait_test.cc b/net/dcsctp/packet/tlv_trait_test.cc index 413c71e452..a0dd1a1136 100644 --- a/net/dcsctp/packet/tlv_trait_test.cc +++ b/net/dcsctp/packet/tlv_trait_test.cc @@ -77,7 +77,7 @@ struct TwoByteTypeConfig { static constexpr int kTypeSizeInBytes = 2; static constexpr int kType = 31337; static constexpr size_t kHeaderSize = 8; - static constexpr int kVariableLengthAlignment = 4; + static constexpr int kVariableLengthAlignment = 2; }; class TwoByteChunk : public TLVTrait { @@ -122,5 +122,12 @@ TEST(TlvDataTest, CanReadTwoByteTypeTlvs) { ElementsAre(0x05, 0x06, 0x07, 0x08, 0xDE, 0xAD, 0xBE, 0xEF)); } +TEST(TlvDataTest, CanHandleInvalidLengthSmallerThanFixedSize) { + // Has 'length=6', which is below the kHeaderSize of 8. + uint8_t data[] = {0x7A, 0x69, 0x00, 0x06, 0x01, 0x02, 0x03, 0x04}; + + EXPECT_FALSE(TwoByteChunk::Parse(data).has_value()); +} + } // namespace } // namespace dcsctp