[coap] fix payload marker removal and add payload marker check (#3936)

src/core/coap/coap_message.cpp

@@ -261,7 +261,14 @@ const otCoapOption *Message::GetNextOption(void)
     }
     else
     {
+        // RFC7252 (Section 3):
+        // Reserved for payload marker.
         VerifyOrExit(optionLength == 0xf, error = OT_ERROR_PARSE);
+
+        // The presence of a marker followed by a zero-length payload MUST be processed
+        // as a message format error.
+        VerifyOrExit(GetHelpData().mNextOptionOffset < GetLength(), error = OT_ERROR_PARSE);
+
         ExitNow(error = OT_ERROR_NOT_FOUND);
     }
 
@@ -324,6 +331,9 @@ otError Message::SetPayloadMarker(void)
     SuccessOrExit(error = Append(&marker, sizeof(marker)));
     GetHelpData().mHeaderLength = GetLength();
 
+    // Set offset to the start of payload.
+    SetOffset(GetHelpData().mHeaderLength);
+
 exit:
     return error;
 }

src/core/coap/coap_message.hpp

@@ -589,7 +589,7 @@ private:
         otCoapOption mOption;
         uint16_t     mNextOptionOffset; ///< The byte offset for the next CoAP Option
         uint16_t     mOptionLast;
-        uint16_t     mHeaderOffset;
+        uint16_t     mHeaderOffset; ///< The byte offset for the CoAP Header
         uint16_t     mHeaderLength;
     };
 

src/core/common/message.cpp

@@ -286,6 +286,12 @@ otError Message::SetLength(uint16_t aLength)
     SuccessOrExit(error = ResizeMessage(totalLengthRequest));
     mBuffer.mHead.mInfo.mLength = aLength;
 
+    // Correct offset in case shorter length is set.
+    if (GetOffset() > aLength)
+    {
+        SetOffset(aLength);
+    }
+
 exit:
     return error;
 }