From fa69aeec7945f328accae021e69fc8283f40695d Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Fri, 10 Jun 2016 13:34:51 +0200 Subject: [PATCH] option.c: fixed off-by-one error in Uri-Query encoder This modification fixes a bug in coap_opt_setheader() that could have caused the function's return value to be larger than the value passed as buffer size. As this function is called by make_decoded_option() in uri.c, the subsequent assert() will fire in that case. The bug occurred in the rare case that the contents of a query option were longer 13 bytes and the buffer was smaller than the number of bytes that were needed to encode the content length. This bug has been reported by Oscar Novo. --- src/option.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/option.c b/src/option.c index dd9d0cdb..60c0788d 100644 --- a/src/option.c +++ b/src/option.c @@ -339,7 +339,7 @@ coap_opt_setheader(coap_opt_t *opt, size_t maxlen, opt[0] = delta << 4; } else if (delta < 270) { if (maxlen < 2) { - debug("insufficient space to encode option delta %d", delta); + debug("insufficient space to encode option delta %d\n", delta); return 0; } @@ -347,7 +347,7 @@ coap_opt_setheader(coap_opt_t *opt, size_t maxlen, opt[++skip] = delta - 13; } else { if (maxlen < 3) { - debug("insufficient space to encode option delta %d", delta); + debug("insufficient space to encode option delta %d\n", delta); return 0; } @@ -359,16 +359,16 @@ coap_opt_setheader(coap_opt_t *opt, size_t maxlen, if (length < 13) { opt[0] |= length & 0x0f; } else if (length < 270) { - if (maxlen < skip + 1) { - debug("insufficient space to encode option length %zu", length); + if (maxlen < skip + 2) { + debug("insufficient space to encode option length %zu\n", length); return 0; } opt[0] |= 0x0d; opt[++skip] = length - 13; } else { - if (maxlen < skip + 2) { - debug("insufficient space to encode option delta %d", delta); + if (maxlen < skip + 3) { + debug("insufficient space to encode option delta %d\n", delta); return 0; }