fix potential buffer overflow in tlv_ok()

src/cmdu.c

@@ -101,11 +101,16 @@ void tlv_free_linear(struct tlv *t)
 
 int tlv_ok(struct tlv *t, int rem)
 {
-	uint16_t l = buf_get_be16(&((uint8_t *)t)[1]);
-	if (rem >= sizeof(struct tlv) && l <= rem - 3)
-		return 1;
+	uint16_t l;
 
-	return 0;
+	if (rem < sizeof(struct tlv))
+		return 0;
+
+	l = buf_get_be16(&((uint8_t *)t)[1]);
+	if (l + 3 > rem)
+		return 0;
+
+	return 1;
 }
 
 struct tlv *tlv_next(struct tlv *t, int *rem)