From a5ffdf323dfa551d250d645bac03b69b9202613d Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Thu, 6 Jun 2019 10:12:34 +0200 Subject: [PATCH] coap-server.c: Fix NULL pointer dereferencing in hnd_get() As the field value in struct dynamic_resource_t may be NULL, hnd_get() must check before accessing resource_entry->value->length and resource_entry->value->s. This bug was detected by Andy Ryan doing a GET after a PUT with an empty payload to unknown_put/something. --- examples/coap-server.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/examples/coap-server.c b/examples/coap-server.c index a035f311..7068abc8 100644 --- a/examples/coap-server.c +++ b/examples/coap-server.c @@ -361,7 +361,7 @@ hnd_get(coap_context_t *ctx UNUSED_PARAM, coap_str_const_t *uri_path; int i; dynamic_resource_t *resource_entry = NULL; - + coap_str_const_t value = { 0, NULL }; /* * request will be NULL if an Observe triggered request, so the uri_path, * if needed, must be abstracted from the resource. @@ -386,10 +386,14 @@ hnd_get(coap_context_t *ctx UNUSED_PARAM, resource_entry = &dynamic_entry[i]; + if (resource_entry->value) { + value.length = resource_entry->value->length; + value.s = resource_entry->value->s; + } coap_add_data_blocked_response(resource, session, request, response, token, resource_entry->media_type, -1, - resource_entry->value->length, - resource_entry->value->s); + value.length, + value.s); return; }