CBOR: Be more rigorous in boundary checking

src/coap_oscore.c

@@ -1048,6 +1048,8 @@ coap_oscore_decrypt_pdu(coap_session_t *session,
           coap_bin_const_t kid_context;
 
           kid_context.length = oscore_cbor_get_element_size(&ptr, &length);
+          if (kid_context.length > length)
+            goto error;
           /* This has to fit into an OSCORE option max 255.
            * Initial byte, kid_context size, partial IV size and kid size have to be there
            */
@@ -1163,6 +1165,8 @@ coap_oscore_decrypt_pdu(coap_session_t *session,
           coap_bin_const_t kid_context;
 
           kid_context.length = oscore_cbor_get_element_size(&ptr, &length);
+          if (kid_context.length > length)
+            goto error;
           /* This has to fit into an OSCORE option max 255.
            * Initial byte, kid_context size, partial IV size and kid size have to be there
            */

src/coap_subscribe.c

@@ -239,6 +239,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
       goto oscore_fail;
     oscore_key_id.length = oscore_cbor_get_element_size(&info_buf,
                                                         &info_buf_len);
+    if (oscore_key_id.length > info_buf_len)
+      goto oscore_fail;
     oscore_key_id.s = info_buf;
     info_buf += oscore_key_id.length;
 
@@ -247,6 +249,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     if (ret == CBOR_BYTE_STRING) {
       id_context.length = oscore_cbor_get_element_size(&info_buf,
                                                        &info_buf_len);
+      if (id_context.length > info_buf_len)
+        goto oscore_fail;
       id_context.s = info_buf;
       info_buf += id_context.length;
       have_id_context = 1;
@@ -260,6 +264,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     ret = oscore_cbor_get_next_element(&info_buf, &info_buf_len);
     if (ret == CBOR_BYTE_STRING) {
       aad.length = oscore_cbor_get_element_size(&info_buf, &info_buf_len);
+      if (aad.length > info_buf_len)
+        goto oscore_fail;
       aad.s = info_buf;
       info_buf += aad.length;
       have_aad = 1;
@@ -274,6 +280,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     if (ret == CBOR_BYTE_STRING) {
       partial_iv.length = oscore_cbor_get_element_size(&info_buf,
                                                        &info_buf_len);
+      if (partial_iv.length > info_buf_len)
+        goto oscore_fail;
       partial_iv.s = info_buf;
       info_buf += partial_iv.length;
       have_partial_iv = 1;
@@ -288,6 +296,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     if (ret == CBOR_BYTE_STRING) {
       nonce.length = oscore_cbor_get_element_size(&info_buf,
                                                   &info_buf_len);
+      if (nonce.length > info_buf_len)
+        goto oscore_fail;
       nonce.s = info_buf;
       info_buf += nonce.length;
       have_nonce = 1;

src/oscore/oscore.c

@@ -356,9 +356,10 @@ oscore_generate_nonce(cose_encrypt0_t *ptr,
   } else {
     tmp_len = ptr->key_id.length;
   }
-  memcpy(&(buffer[((size - 5) - tmp_len)]),
-         ptr->key_id.s,
-         tmp_len);
+  if (ptr->key_id.s)
+    memcpy(&(buffer[((size - 5) - tmp_len)]),
+           ptr->key_id.s,
+           tmp_len);
   /* S */
   buffer[0] = (uint8_t)tmp_len;
   /* PIV */

src/oscore/oscore_cbor.c

@@ -358,6 +358,8 @@ oscore_cbor_get_string_array(const uint8_t **data, size_t *buf_len,
 
   uint8_t elem = oscore_cbor_get_next_element(data, buf_len);
   *len = oscore_cbor_get_element_size(data, buf_len);
+  if (*len > *buf_len)
+    return 1;
   *result = NULL;
   void *rs = coap_malloc_type(COAP_STRING, *len);
   *result = (uint8_t *)rs;