obgm/libcoap
2
0 Fork 0
mirror of https://github.com/obgm/libcoap.git synced 2026-10-28 13:35:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

OSCORE: Don't read the option value before the length check

Browse Source 
oscore_decode_option_value() read opt_value[0] before the early return
for a zero-length (empty) option, so an empty OSCORE option dereferenced
a byte the option does not own. Move the read after the length check.
This commit is contained in:
Scorpion authored and Jon Shallow committed 2026-10-22 13:06:45 +01:00
1 parent dc2f20b55b
commit 51a156f7cb
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
src/oscore/oscore.c
+2 -1
View File
@@ -275,7 +275,7 @@ int
oscore_decode_option_value(const uint8_t *opt_value,
size_t option_len,
cose_encrypt0_t *cose) {
uint8_t partial_iv_len = (opt_value[0] & 0x07);
uint8_t partial_iv_len;
size_t offset = 1;
cose->oscore_option.s = opt_value;
@@ -284,6 +284,7 @@ oscore_decode_option_value(const uint8_t *opt_value,
if (option_len == 0)
return 1; /* empty option */
partial_iv_len = (opt_value[0] & 0x07);
if (option_len > 255 || partial_iv_len == 6 || partial_iv_len == 7 ||
(opt_value[0] & 0xC0) != 0) {
return 0;