From 2a148199966c9fc59693566cc3a2016adf4ea430 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Wed, 23 Jan 2019 08:47:48 -0800
Subject: [PATCH] [coap] return error if CoAP options exceeds message length
 (#3493)

---
 src/core/coap/coap_message.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/core/coap/coap_message.cpp b/src/core/coap/coap_message.cpp
index f11e00416..5580e0a08 100644
--- a/src/core/coap/coap_message.cpp
+++ b/src/core/coap/coap_message.cpp
@@ -271,6 +271,8 @@ const otCoapOption *Message::GetNextOption(void)
         ExitNow();
     }
 
+    VerifyOrExit(optionLength <= GetLength() - GetHelpData().mNextOptionOffset, error = OT_ERROR_PARSE);
+
     rval = &GetHelpData().mOption;
     rval->mNumber += optionDelta;
     rval->mLength = optionLength;