espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-28 14:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[coap] ensure CoAP header and token length are validated (#10720)

Browse Source 
This commit updates `Coap::Message::ParseHeader()` to perform two
crucial validations:
- It now checks if the message contains sufficient bytes to read the
  minimum 4-byte CoAP header.
- Afterwards, determines the CoAP token length from the read header,
  and then validates that the message has enough bytes to read the
  token.

These validations prevent the parsing and misinterpretation of a
malformed or incomplete CoAP message as a valid one,
This commit is contained in:
Abtin Keshavarzian
2024-09-17 12:14:57 -07:00
committed by GitHub
parent 4a57dd8e09
commit f12dfaf531
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/coap/coap_message.cpp
+7 -3
View File
@@ -373,7 +373,8 @@ exit:
Error Message::ParseHeader(void)
{
Error error = kErrorNone;
Error error = kErrorNone;
uint16_t offset = GetOffset();
Option::Iterator iterator;
OT_ASSERT(GetReserved() >=
@@ -381,10 +382,13 @@ Error Message::ParseHeader(void)
GetHelpData().Clear();
GetHelpData().mHeaderOffset = GetOffset();
IgnoreError(Read(GetHelpData().mHeaderOffset, GetHelpData().mHeader));
GetHelpData().mHeaderOffset = offset;
SuccessOrExit(error = Read(offset, &GetHelpData().mHeader, kMinHeaderLength));
offset += kMinHeaderLength;
VerifyOrExit(GetTokenLength() <= kMaxTokenLength, error = kErrorParse);
SuccessOrExit(error = Read(offset, GetHelpData().mHeader.mToken, GetTokenLength()));
SuccessOrExit(error = iterator.Init(*this));