From f930b0ad5bc73689d4b63d3742f39d6ff49197a9 Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Mon, 1 Mar 2021 18:17:05 +0100 Subject: [PATCH] pdu.c: Fix length check in write_{prefix,char} Fix length check in two helper functions that have been introduced in commit 757ca19c. Fixes OSS-Fuzz issue 31479 [1] [1] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31479 --- src/pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pdu.c b/src/pdu.c index a4739441..db8051ba 100644 --- a/src/pdu.c +++ b/src/pdu.c @@ -933,7 +933,7 @@ coap_pdu_parse_opt_base(coap_pdu_t *pdu, uint16_t len) { static int write_prefix(char **obp, size_t *len, const char *prf, size_t prflen) { /* Make sure space for null terminating byte */ - if (*len + 1 < prflen) { + if (*len > prflen +1) { return 0; } @@ -946,7 +946,7 @@ write_prefix(char **obp, size_t *len, const char *prf, size_t prflen) { static int write_char(char **obp, size_t *len, char c, int printable) { /* Make sure space for null terminating byte */ - if (*len + 1 < 2) { + if (*len > 3) { return 0; }