From 09e91a2e5c9618b85ec45801aecd3ae49e1a11c2 Mon Sep 17 00:00:00 2001
From: 94xhn <87560781+94xhn@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:06:56 +0800
Subject: [PATCH] coap_resource.c: harden coap_print_wellknown_lkd() against
 short attribute values

In the "match attribute" branch of coap_print_wellknown_lkd(), an
attribute value shorter than 2 bytes (e.g. a lone " registered via
coap_add_attr()) causes attr->value->s[0] == '"' to read past the
value, and unquoted_val.length -= 2 to underflow the size_t length
to SIZE_MAX. The resulting bogus coap_str_const_t is then passed to
match(), which dereferences memory far outside the original buffer.

Guard the quote-check on length >= 2 before reading s[0], mirroring
the length && ... guard already used a few lines above for
query_pattern (added in #1977) and the trailing-'*' guard next to
it.

Reproduced with a standalone harness placing a 1-byte attribute
value at the end of a guard-paged region: pre-fix, unquoted_val.length
becomes SIZE_MAX and match() crashes on the guard page; post-fix,
length stays at the original value (no underflow) and match() safely
short-circuits. A normal quoted value ("foo", 5 bytes) still strips
to foo (3 bytes) unchanged, confirming no regression.
---
 src/coap_resource.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/coap_resource.c b/src/coap_resource.c
index f154b1cc..52dcbfec 100644
--- a/src/coap_resource.c
+++ b/src/coap_resource.c
@@ -213,7 +213,8 @@ coap_print_wellknown_lkd(coap_context_t *context, unsigned char *buf,
         if (!attr || !attr->value)
           continue;
         unquoted_val = *attr->value;
-        if (attr->value->s[0] == '"') {          /* if attribute has a quoted value, remove double quotes */
+        /* if attribute has a quoted value, remove double quotes */
+        if (attr->value->length >= 2 && attr->value->s[0] == '"') {
           unquoted_val.length -= 2;
           unquoted_val.s += 1;
         }