From 2dec88fc4168fe487afd6356318e2ef0489c94f4 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Mon, 24 Feb 2020 09:19:22 -0800
Subject: [PATCH] [coap] validate token length on received messages (#4584)

Per RFC 7252:

- Treat invalid token length as a message format error.

- Rejecting a Confirmable message is effected by sending a matching
  Reset message and otherwise ignoring it.
---
 src/core/coap/coap.cpp         | 5 +++++
 src/core/coap/coap_message.cpp | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/src/core/coap/coap.cpp b/src/core/coap/coap.cpp
index d4b143c56..ab2624944 100644
--- a/src/core/coap/coap.cpp
+++ b/src/core/coap/coap.cpp
@@ -439,6 +439,11 @@ void CoapBase::Receive(ot::Message &aMessage, const Ip6::MessageInfo &aMessageIn
     if (message.ParseHeader() != OT_ERROR_NONE)
     {
         otLogDebgCoap("Failed to parse CoAP header");
+
+        if (!aMessageInfo.GetSockAddr().IsMulticast() && message.IsConfirmable())
+        {
+            SendReset(message, aMessageInfo);
+        }
     }
     else if (message.IsRequest())
     {
diff --git a/src/core/coap/coap_message.cpp b/src/core/coap/coap_message.cpp
index 250872a2e..a32722a5d 100644
--- a/src/core/coap/coap_message.cpp
+++ b/src/core/coap/coap_message.cpp
@@ -255,6 +255,8 @@ otError Message::ParseHeader(void)
     GetHelpData().mHeaderOffset = GetOffset();
     Read(GetHelpData().mHeaderOffset, sizeof(GetHelpData().mHeader), &GetHelpData().mHeader);
 
+    VerifyOrExit(GetTokenLength() <= kMaxTokenLength, error = OT_ERROR_PARSE);
+
     SuccessOrExit(error = iterator.Init(this));
     for (const otCoapOption *option = iterator.GetFirstOption(); option != NULL; option = iterator.GetNextOption())
     {