From 912cae62d7f82e3ba1bf9e004d239f737dd71a0e Mon Sep 17 00:00:00 2001
From: Jon Shallow <supjps-libcoap@jpshallow.com>
Date: Sat, 4 Apr 2026 09:08:33 +0100
Subject: [PATCH] CBOR: Be more rigorous in boundary checking

---
 src/coap_oscore.c        |  4 ++++
 src/coap_subscribe.c     | 10 ++++++++++
 src/oscore/oscore.c      |  7 ++++---
 src/oscore/oscore_cbor.c |  2 ++
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/coap_oscore.c b/src/coap_oscore.c
index 14209408..fb440f99 100644
--- a/src/coap_oscore.c
+++ b/src/coap_oscore.c
@@ -1048,6 +1048,8 @@ coap_oscore_decrypt_pdu(coap_session_t *session,
           coap_bin_const_t kid_context;
 
           kid_context.length = oscore_cbor_get_element_size(&ptr, &length);
+          if (kid_context.length > length)
+            goto error;
           /* This has to fit into an OSCORE option max 255.
            * Initial byte, kid_context size, partial IV size and kid size have to be there
            */
@@ -1163,6 +1165,8 @@ coap_oscore_decrypt_pdu(coap_session_t *session,
           coap_bin_const_t kid_context;
 
           kid_context.length = oscore_cbor_get_element_size(&ptr, &length);
+          if (kid_context.length > length)
+            goto error;
           /* This has to fit into an OSCORE option max 255.
            * Initial byte, kid_context size, partial IV size and kid size have to be there
            */
diff --git a/src/coap_subscribe.c b/src/coap_subscribe.c
index 149f8f83..e9d9d6ee 100644
--- a/src/coap_subscribe.c
+++ b/src/coap_subscribe.c
@@ -239,6 +239,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
       goto oscore_fail;
     oscore_key_id.length = oscore_cbor_get_element_size(&info_buf,
                                                         &info_buf_len);
+    if (oscore_key_id.length > info_buf_len)
+      goto oscore_fail;
     oscore_key_id.s = info_buf;
     info_buf += oscore_key_id.length;
 
@@ -247,6 +249,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     if (ret == CBOR_BYTE_STRING) {
       id_context.length = oscore_cbor_get_element_size(&info_buf,
                                                        &info_buf_len);
+      if (id_context.length > info_buf_len)
+        goto oscore_fail;
       id_context.s = info_buf;
       info_buf += id_context.length;
       have_id_context = 1;
@@ -260,6 +264,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     ret = oscore_cbor_get_next_element(&info_buf, &info_buf_len);
     if (ret == CBOR_BYTE_STRING) {
       aad.length = oscore_cbor_get_element_size(&info_buf, &info_buf_len);
+      if (aad.length > info_buf_len)
+        goto oscore_fail;
       aad.s = info_buf;
       info_buf += aad.length;
       have_aad = 1;
@@ -274,6 +280,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     if (ret == CBOR_BYTE_STRING) {
       partial_iv.length = oscore_cbor_get_element_size(&info_buf,
                                                        &info_buf_len);
+      if (partial_iv.length > info_buf_len)
+        goto oscore_fail;
       partial_iv.s = info_buf;
       info_buf += partial_iv.length;
       have_partial_iv = 1;
@@ -288,6 +296,8 @@ coap_persist_observe_add_lkd(coap_context_t *context,
     if (ret == CBOR_BYTE_STRING) {
       nonce.length = oscore_cbor_get_element_size(&info_buf,
                                                   &info_buf_len);
+      if (nonce.length > info_buf_len)
+        goto oscore_fail;
       nonce.s = info_buf;
       info_buf += nonce.length;
       have_nonce = 1;
diff --git a/src/oscore/oscore.c b/src/oscore/oscore.c
index d6f973b4..3016a281 100644
--- a/src/oscore/oscore.c
+++ b/src/oscore/oscore.c
@@ -356,9 +356,10 @@ oscore_generate_nonce(cose_encrypt0_t *ptr,
   } else {
     tmp_len = ptr->key_id.length;
   }
-  memcpy(&(buffer[((size - 5) - tmp_len)]),
-         ptr->key_id.s,
-         tmp_len);
+  if (ptr->key_id.s)
+    memcpy(&(buffer[((size - 5) - tmp_len)]),
+           ptr->key_id.s,
+           tmp_len);
   /* S */
   buffer[0] = (uint8_t)tmp_len;
   /* PIV */
diff --git a/src/oscore/oscore_cbor.c b/src/oscore/oscore_cbor.c
index c7badea3..8176372a 100644
--- a/src/oscore/oscore_cbor.c
+++ b/src/oscore/oscore_cbor.c
@@ -358,6 +358,8 @@ oscore_cbor_get_string_array(const uint8_t **data, size_t *buf_len,
 
   uint8_t elem = oscore_cbor_get_next_element(data, buf_len);
   *len = oscore_cbor_get_element_size(data, buf_len);
+  if (*len > *buf_len)
+    return 1;
   *result = NULL;
   void *rs = coap_malloc_type(COAP_STRING, *len);
   *result = (uint8_t *)rs;