obgm/libcoap
2
0 Fork 0
mirror of https://github.com/obgm/libcoap.git synced 2026-11-01 07:25:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

pdu.c: fix heap overflow in coap_pdu_parse_opt()

Browse Source 
coap_opt_length() must be called next_option_safe() to avoid
out-of-bound reads for malformed options.

Thanks to Marten Geuking for providing a detailed bug report.
This commit is contained in:
Olaf Bergmann committed 2021-01-13 15:34:09 +01:00
1 parent 7e6b2a9ec3
commit 238fded2d8
1 file changed
+5 -4
Download Patch File Download Diff File Expand all files Collapse all files
src/pdu.c
+5 -4
View File
@@ -701,12 +701,13 @@ coap_pdu_parse_opt(coap_pdu_t *pdu) {
/* skip header + token */
coap_opt_t *opt = pdu->token + pdu->token_length;
size_t length = pdu->used_size - pdu->token_length;
uint32_t len;
while (length > 0 && *opt != COAP_PAYLOAD_START) {
len = coap_opt_length(opt);
if ( !next_option_safe( &opt, &length, &pdu->max_opt ) ) {
coap_log(LOG_DEBUG, "coap_pdu_parse: missing payload start code\n");
size_t optsize = next_option_safe(&opt, &length, &pdu->max_opt);
const uint32_t len =
optsize ? coap_opt_length((const uint8_t *)opt - optsize) : 0;
if (optsize == 0) {
coap_log(LOG_DEBUG, "coap_pdu_parse: malformed option\n");
return 0;
}
if (COAP_PDU_IS_SIGNALING(pdu)) {